Summary
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Mattermost ist ein webbasierter Instant-Messaging-Dienst.
Vulnerabilities 9
-
Medium 6.5
Unauthorized users can trigger interactive post actions in private channels via action cookie channel mismatch in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigge…
-
Medium 6.5
Crafted message attachment causes client-side denial of service via markdown parser regex backtracking in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post c…
-
Medium 5.9
Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh token grant in Mattermost
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional …
-
Medium 5.4
Ordinary group/direct message member can enable group_constrained and remove all channel participants
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remov…
-
Medium 4.9
Incoming webhook user attribution via unvalidated webhook owner
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direc…
-
Medium 4.3
Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remot…
-
Medium 4.3
Unscoped updates to other playbooks' metric configuration
Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a c…
-
Medium 4.3
Remote cluster metadata enumeration via /share-channel autocomplete
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remo…
-
Low 3.8
Mattermost schemes teams endpoint exposes private team invite IDs
Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to thos…
Revision history
-
#3
Referenz(en) aufgenommen: CVE-2026-9824, GHSA-274R-72WH-M76C, CVE-2026-9820, EUVD-2026-43340, CVE-2026-10106, EUVD-2026-43312, CVE-2026-6850, EUVD-2026-43313, EUVD-2026-43339, CVE-2026-6541, EUVD-2026-43341, CVE-2026-10085, EUVD-2026-43311, CVE-2026-9708, EUVD-2026-43308
-
#2
Referenz(en) aufgenommen: CVE-2026-9571, GHSA-4V7J-4MVR-5975
-
#1
Initiale Fassung
References
-
Mattermost Security Updates vom 2026-06-15
https://mattermost.com/security-updates/