Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-86348 EUVD-2026-77481GHSA-hw33-g6h4-vc78

MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process

Published Sep 14, 2026 · Updated Sep 14, 2026 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost

Description

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701

Affected products

VendorProductAffectedFixed
Mattermost Mattermost <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 – ≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 11.10.0

Advisories 1

References