Product · Mattermost

github.com/mattermost/mattermost/server/public

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Medium 5.4

CVE-2026-13426

Client4 fails to validate path parameters

The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing pat…

Mattermost github.com/mattermost/mattermost/server/public github.com/mattermost/mattermost/server/public Go

Jun 26, 2026