These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
## Summary Mattermost versions 11.6.x through 11.6.0, 11.5.x through 11.5.3, 11.4.x through 11.4.4, and 10.11.x through 10.11.14 contain a denial-of-service vulnerability in outgoing webhook processing. An authenticated attacker can trigger server process termination by sending a crafted webhook callback response containing a null attachment entry. The root cause is improper filtering of nil elements in w [truncated]
CVE-2026-28735 is a medium-severity vulnerability affecting Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. The issue arises from the failure to validate the OAuth token scope on the callback, which allows an authenticated Mattermost user to gain access to private repositories by modifying the scope parameter in the GitHub authorization URL. This v [truncated]
CVE-2026-5755 is a denial of service vulnerability in Mattermost Server versions 10.11.x through 11.6.x. Authenticated users with file upload or posting permissions can cause a server OOM by uploading a crafted TIFF file or posting a URL that serves one. This vulnerability occurs due to insufficient validation of TIFF IFD offsets in image headers before memory allocation. Users of affected versions should [truncated]
CVE-2026-5740 is a high-severity vulnerability affecting Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. The vulnerability allows an unauthenticated remote attacker to crash the server process by sending a crafted binary WebSocket message to the public WebSocket endpoint, resulting in a full service outage for all users. The vulnerability is caused [truncated]
CVE-2026-5308 is a denial of service vulnerability in Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14. The vulnerability occurs because the affected versions fail to enforce request body size limits on plugin HTTP endpoints, allowing an attacker to cause a denial of service via crafted oversized HTTP requests. This vulnerability has a CVSS score of 4.9, [truncated]
CVE-2026-4646 is a medium-severity vulnerability affecting Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. The vulnerability allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. The Mattermost Advisory ID for this vulnerability is MMSA-2026-00638. This issue has a CVSS score of 4.3 and [truncated]
CVE-2026-4635 is a medium-severity vulnerability affecting Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. The issue arises from the failure to archive channels before removing persistent notifications, allowing an authenticated user to crash the server by timing the creation of persistent notification messages between server deletion of existing n [truncated]
CVE-2026-3636 is a medium-severity vulnerability in Mattermost Server, affecting versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. The issue allows users without elevated permissions to obtain data about team members' roles by invoking various team API endpoints. This vulnerability has been analyzed and addressed by the vendor. The affected product is Mattermost Serve [truncated]
CVE-2026-4858 is a Mattermost path traversal issue in integration action URL handling. According to the published description, a malicious authenticated user can bypass URL checks and use path traversal to call arbitrary APIs with the system admin Mattermost auth token. The issue is tracked by Mattermost as advisory MMSA-2026-00640 and is rated CVSS 8.0 (HIGH).
CVE-2026-22880 describes an SSO callback origin validation weakness in Mattermost Mobile Apps. According to the NVD entry and Mattermost reference, a malicious Mattermost server can abuse the mobile app’s SSO flow to relay the authentication exchange and capture credentials or tokens intended for a legitimate server. The issue is publicly disclosed with CWE-352 context and a CVSS 3.1 score of 6.1 (medium).
CVE-2026-4055 is a team-scoped authorization flaw in Mattermost playbook run creation. According to the NVD summary, versions 11.5.x through 11.5.1 fail to validate the target team’s run_create permission when a playbook run is created, which can let an authenticated team member create runs in a team where they do not have permission by specifying a different team ID in the API request. The issue is rated [truncated]
CVE-2026-6347 is a high-severity information disclosure issue in the Mattermost Calls plugin. In affected Mattermost releases, sensitive configuration fields are not properly sanitized when a support packet is generated, which can leave TURN server credentials in plaintext inside the exported plugin configuration. Anyone with access to that support packet could recover the credentials. The CVE was publish [truncated]
Mattermost fixed a credential-exposure issue in support packet generation that affected specific 10.11.x, 11.4.x, and 11.5.x releases. On vulnerable versions, sensitive configuration fields were not sanitized before a support packet was created, so a System Admin or anyone with access to the packet could retrieve plaintext credentials from the downloaded file. NVD rates the issue as high severity (CVSS 8. [truncated]
CVE-2026-6345 describes a Mattermost Server issue where created user passwords were not adequately protected from disclosure. According to the vendor and NVD, a malicious attacker with sufficient privileges could use exposed passwords to impersonate a user. The issue is rated medium severity with high confidentiality and integrity impact.
CVE-2026-6343 is a Mattermost authorization issue published on 2026-05-18. According to the vendor/NVD record, certain Mattermost Server versions fail to correctly enforce public/private permissions, which can allow users without those permissions to access public playbooks through the /get endpoint. NVD rates the issue CVSS 3.1 4.3 (Medium), with low-privilege, network-reachable access and a confidential [truncated]
CVE-2026-6339 is a Mattermost vulnerability published on 2026-05-18 that can let an authenticated channel member force the reveal of a burn-on-read message without recipient consent. The issue affects Mattermost Server 11.4.0 through 11.4.3 and 11.5.0 through 11.5.1, with vendor and NVD records identifying it as a low-severity, network-reachable issue with limited availability impact.
CVE-2026-4286 is a low-severity Mattermost authorization issue affecting playbook updates. According to the vendor and NVD data, users with only Manage Playbook Configurations permission could change a playbook’s team through the update API because the application did not verify whether {{team_id}} was being changed. That bypassed the intended manage members restriction for team changes. The affected rang [truncated]
CVE-2026-3471 is a medium-severity denial-of-service issue in the Mattermost Desktop App. According to the CVE description, the app fails to block an invalid URL from loading inside a pop-up window, which can let a malicious server owner repeatedly crash the application by invoking window.open('javascript:alert()');. The issue was publicly disclosed on 2026-05-18 and is associated with Mattermost advisory [truncated]
A missing authorization check in the Mattermost GitLab plugin allows authenticated users to perform administrative actions. The vulnerability exists in the plugin's command handlers for `gitlab instance` and `/gitlab webhook` commands, which fail to verify that the invoking user has appropriate permissions before executing instance uninstallation or webhook configuration operations. This represents a clas [truncated]
CVE-2026-6342 is a low-complexity authorization flaw in Mattermost Plugins that can let a plugin user create subscriptions to groups they were not supposed to access. The issue stems from insufficient validation of namespaces: if a user can create a group whose name shares a prefix with a whitelisted group, the plugin may treat it as valid. Mattermost’s advisory and the NVD record both tie this to a permi [truncated]
A missing authorization check in Mattermost Plugins allows authenticated users with membership in multiple groups to bypass group-level restrictions when creating issues or attaching comments via direct API requests. The vulnerability stems from insufficient API-level validation of group permissions, enabling users to interact with locked groups they should not access. This affects Mattermost Plugins vers [truncated]
CVE-2026-6340 is a denial-of-service issue in Mattermost’s handling of 7zip archives. According to the provided description, affected versions fail to validate 7zip archive structure before processing, allowing an authenticated attacker to upload a specially crafted archive with excessive folder declarations and trigger server memory exhaustion. The result is loss of availability rather than direct data e [truncated]
CVE-2026-6334 is a low-severity OAuth authorization flaw reported for Mattermost. According to the CVE description and NVD record, affected versions fail to enforce client identity binding during authorization code redemption, which can allow one authenticated OAuth client to redeem an authorization code issued to a different client. The issue was published on 2026-05-18 and the only cited vendor referenc [truncated]
A vulnerability in Mattermost Server versions 11.5.x through 11.5.1 and 10.11.x through 10.11.13 allows an authenticated attacker to bypass token rotation during remote cluster invite confirmation. The root cause is a missing validation check that the RefreshedToken differs from the original invite token. By sending a crafted invite confirmation with a RefreshedToken matching the original token, an attack [truncated]
Mattermost Server versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3 contain an authorization bypass vulnerability. The application fails to validate the `create_post` channel permission when processing post edit operations. An authenticated attacker whose posting privileges have been revoked can continue to modify their existing posts by sending direct API requests to the [truncated]
Mattermost Server versions 11.5.x through 11.5.1 and 10.11.x through 10.11.13 contain a stored cross-site scripting (XSS) vulnerability in error page composition. The application fails to properly escape variables that may contain malicious content when rendering error pages. An attacker with administrative privileges to edit site configuration can inject JavaScript payloads into these variables, which ex [truncated]
CVE-2026-28759 is a Mattermost server authorization flaw in shared channel membership synchronization. A malicious remote cluster can send crafted membership sync messages and remove users from channels it is not allowed to access, including private channels. NVD rates the issue CVSS 4.3 (MEDIUM).
Mattermost Plugin Legal Hold versions <=1.1.4 are vulnerable due to a failed authorization check in ServeHTTP, allowing authenticated attackers to access, create, download, and delete legal hold data via crafted API requests. This vulnerability affects Mattermost Plugin Legal Hold deployments. The CVE record was published on 2026-04-06T13:17:18.417Z. Users should verify affected deployments and review ven [truncated]
CVE-2026-25773 is a high-severity vulnerability in Focalboard 8.0, allowing authenticated attackers to inject malicious SQL payloads and exfiltrate sensitive data, including password hashes of other users. The vulnerability occurs due to improper sanitization of category IDs in dynamic SQL statements when reordering categories. This Second-Order SQL Injection (Time-Based Blind) vulnerability can be exploi [truncated]
CVE-2026-3116 is a vulnerability in Mattermost Plugins versions <=11.4, 11.0.4, 11.1.3, 11.3.2, 10.11.11.0. The vulnerability fails to validate incoming request size, allowing an authenticated attacker to cause service disruption via the webhook endpoint. The vulnerability has a CVSS score of 4.9 and a severity of MEDIUM.
