Skip to content
OpenAdvisories
Low WID-SEC-2026-3361 3 CVEs

Mattermost Server: Mehrere Schwachstellen

Published Sep 14, 2026 · Updated Sep 14, 2026 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mattermost Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-91181

    Data Retention Teams Endpoint Leaks Private Team Invite ID

    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permi…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-86348

    MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

    Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-86349

    Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting

    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting depth in the server-side Markdown parser which allows an authenticated attacker to cause a denial of service (CPU resource exhaustion) via …

    Mattermost Mattermost

Revision history

  1. #1

    Initiale Fassung

References