Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 00:48:10 +0000 CVE-2026-28741 — CSRF Protection Bypass Allows Updating a User's Authentication Method https://vulnerability.circl.lu/vuln/cve-2026-28741 <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost versions 10.11.x &lt;= 10.11.12, 11.5.x &lt;= 11.5.0, 11.4.x &lt;= 11.4.2, 11.3.x &lt;= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user&#39;s authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625</p> <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost versions 10.11.x &lt;= 10.11.12, 11.5.x &lt;= 11.5.0, 11.4.x &lt;= 11.4.2, 11.3.x &lt;= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user&#39;s authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625</p> https://vulnerability.circl.lu/vuln/cve-2026-28741