CVE-2026-28735 Mattermost CVE debrief

Who should care

Administrators and users of Mattermost Server, particularly those using GitHub for authentication and authorization, should be aware of this vulnerability. It is crucial for them to assess their exposure and take necessary actions to mitigate the risk. This includes updating to a patched version and reviewing OAuth token scopes and GitHub authorization settings.

Technical summary

The vulnerability is caused by inadequate validation of OAuth token scopes during the callback process in Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. This oversight enables an authenticated user to manipulate the scope parameter in the GitHub authorization URL, potentially granting unauthorized access to private repositories. The issue emphasizes the need for prompt remediation. Administrators should assess their exposure and take necessary actions to mitigate the risk, including updating to a patched version and reviewing OAuth token scopes and GitHub authorization settings.

Defensive priority

Medium-High due to potential for unauthorized access to private repositories via GitHub authorization manipulation by authenticated users. Immediate remediation is recommended for exposed systems, especially those with high-risk exposure or sensitive data at risk of unauthorized access through GitHub integrations. Defenders should prioritize updating Mattermost Server to a version that fixes the vulnerability and review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring for suspicious activity related to authentication and authorization is also crucial. Additionally, defenders should consider the operational impact of this vulnerability on their systems and implement measures to prevent similar issues in the future. This may involve enhancing vulnerability management processes and improving the security posture of Mattermost Server deployments. By taking these steps, defenders can reduce the risk associated with this vulnerability and protect their systems from potential exploitation. It is also essential to track exceptions, retest remediated assets, and close the item only after evidence is documented to ensure that the remediation efforts are effective and sustainable over time. Furthermore, defenders should review relevant monitoring, detection, and logs for exposed assets that need extra review to identify potential security incidents related to this vulnerability. By doing so, they can quickly respond to and contain any potential security breaches, minimizing the impact of the vulnerability on their systems and data. Overall, a comprehensive and proactive approach to addressing this vulnerability is necessary to ensure the security and integrity of Mattermost Server deployments. This includes not only immediate remediation but also ongoing monitoring, vulnerability management, and security enhancements to prevent similar issues in the future. By prioritizing these efforts, defenders can protect their systems and data from the potential risks associated with CVE-2026-28735. In addition to these measures, defenders should also consider implementing asset inventory management to keep track of affected systems and

Recommended defensive actions

• Update Mattermost Server to a version that fixes the vulnerability (e.g., 11.6.1, 11.5.4, 11.4.5, or 10.11.15).
• Review and adjust OAuth token scopes and GitHub authorization settings.
• Monitor for suspicious activity related to authentication and authorization.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its CVSS score and affected versions. The vendor advisory from Mattermost offers guidance on mitigation and remediation. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for specific mitigation steps.

Official resources