Skip to content
OpenAdvisories
Low WID-SEC-2026-0692 2 CVEs

Mattermost MS Teams plugin: Mehrere Schwachstellen ermöglichen Denial of Service

Published Mar 10, 2026 · Updated Apr 9, 2026 · Revision 2 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Mattermost MS Teams plugin ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 2

  • Low 3.7
    CVE-2026-21388

    Unbounded Request Body Read in MS Teams Plugin {{/lifecycle}} Webhook Endpoint

    Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory I…

    Mattermost Mattermost github.com/mattermost/mattermost-plugin-msteams Go
  • Low 3.7
    CVE-2026-24661

    Unbounded Request Body Read in MS Teams Plugin {{/changes}} Webhook Endpoint

    Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory I…

    Mattermost Mattermost github.com/mattermost/mattermost-plugin-msteams Go

Revision history

  1. #2

    Neue Informationen von Mattermost aufgenommen

  2. #1

    Initiale Fassung

References