Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 3

• High 8.0
  CVE-2026-4858

  Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

  Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using v…

  Mattermost Mattermost github.com/mattermost/mattermost-server Go
  May 21, 2026
• Medium 5.4
  CVE-2026-28735

  GitHub OAuth Scope Validation

  Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope p…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-plugin-github Go
  May 22, 2026
• Medium 4.3
  CVE-2026-4055

  Insufficient permission validation on cross-team playbook run creation

  Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticated team member to create runs in teams where they lack permission via specifying a different…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  May 21, 2026

Revision history

1. 2026-05-25 #3

   Neue Updates

2. 2026-05-20 #2

   Referenz(en) aufgenommen: CVE-2026-4055, EUVD-2026-31221, CVE-2026-4858, EUVD-2026-31242

3. 2026-04-19 #1

   Initiale Fassung

References

• Mattermost Security Updates vom 2026-04-19
  https://mattermost.com/security-updates/#server