Skip to content
OpenAdvisories
Medium WID-SEC-2026-1154 7 CVEs

Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Apr 15, 2026 · Updated May 18, 2026 · Revision 3 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 7

  • Medium 6.5
    CVE-2026-3117

    Instance and webhook GitLab plugin commands were able to be run by non-admin users

    Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}}…

    Mattermost Mattermost
  • Medium 6.5
    CVE-2026-5163

    Missing authorization check in AI message rewrite endpoint allows access to private thread content

    Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.3
    CVE-2026-4054

    SVG content served through Mattermost image proxy despite Content-Type restrictions causes client-side denial of service

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to validate the response body of proxied images, which allows a remote attacker to enact client-side DoS via an SVG file served from an attacker-controlled origin under a non-SVG…

    Mattermost Mattermost github.com/mattermost/mattermost-server Go
  • Medium 4.3
    CVE-2026-6339

    Missing request origin validation on burn-on-read reveal endpoint

    Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.3
    CVE-2026-6341

    Incomplete group locking implementation

    Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API …

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-6342

    Group prefix matching bypass for subscriptions

    Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to appropriately check for valid namespaces which allows plugin users to create subscriptions to groups that were not whitelisted via creating groups that share the same prefix as a whitelisted …

    Mattermost Mattermost
  • Low 3.1
    CVE-2026-4053

    post edit time limit is not enforced on some post update operations

    Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post…

    Mattermost Mattermost github.com/mattermost/mattermost-server Go

Revision history

  1. #3

    CVE ergänzt

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References