Skip to content
OpenAdvisories
Medium WID-SEC-2026-3519 3 CVEs

Mattermost Server: Mehrere Schwachstellen

Published Sep 22, 2026 · Updated Sep 22, 2026 · de-DE

Vendor: Mattermost Product: Mattermost Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mattermost Server ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.

Product

Mattermost ist ein webbasierter Instant-Messaging-Dienst.

Vulnerabilities 3

  • Medium 6.5
    CVE-2026-96260

    Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of…

    Mattermost Mattermost
  • Medium 5.5
    CVE-2026-96259

    Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network ad…

    Mattermost Mattermost
  • Medium 4.3
    CVE-2026-95666

    Unbounded post ID array in the bulk reactions endpoint allows denial of service

    Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a craft…

    Mattermost Mattermost

Revision history

  1. #1

    Initiale Fassung

References