Mattermost Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Summary

Product

Vulnerabilities 6

• High 8.8
  CVE-2026-7387

  Mattermost group syncable endpoints allow privilege escalation via scheme_admin

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with …

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026
• High 7.6
  CVE-2026-6961

  CVE-2026-6961: Path traversal via unsanitized FileInfo.Name in Mattermost federation sync

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026
• Medium 6.7
  CVE-2026-6739

  Mattermost: Delegated admins could patch protected default system roles

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions …

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026
• Medium 5.3
  CVE-2026-6046

  Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account, which allows an unprivileged attacker to intercept private messages se…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026
• Medium 4.3
  CVE-2026-3433

  Mattermost fails to scope role_updated websocket events to authorized team and channel members

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026
• Medium 4.3
  CVE-2026-6689

  *Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*

  Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allow…

  Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  Jun 12, 2026

Revision history

1. 2026-06-14 #2

   Referenz(en) aufgenommen: CVE-2026-3433, CVE-2026-6689, EUVD-2026-36501, CVE-2026-7387, EUVD-2026-36503, CVE-2026-6961, EUVD-2026-36504, CVE-2026-6739, EUVD-2026-36499, CVE-2026-6046, EUVD-2026-36502

2. 2026-05-14 #1

   Initiale Fassung

References

• Mattermost Server Security Updates vom 2026-05-14
  https://mattermost.com/security-updates/#server