Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1292 vulnerabilities by Mattermost

    CVE-2026-9859 (GCVE-0-2026-9859)

    Vulnerability from nvd – Published: 2026-08-17 22:06 – Updated: 2026-08-17 22:06
    VLAI
    Title
    Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-00686
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "kauasilvab14fb3"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-00686"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:06:26.318Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00686",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00686",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69031"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Mattermost Boards plugin didn\u2019t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-9859",
        "datePublished": "2026-08-17T22:06:26.318Z",
        "dateReserved": "2026-05-28T15:58:29.723Z",
        "dateUpdated": "2026-08-17T22:06:26.318Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-9816 (GCVE-0-2026-9816)

    Vulnerability from nvd – Published: 2026-08-17 22:05 – Updated: 2026-08-17 22:05
    VLAI
    Title
    Insufficient server-side validation of board member role fields permits privilege escalation
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "kamil-sawicki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:05:24.910Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00685",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00685",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69022"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Insufficient server-side validation of board member role fields permits privilege escalation",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-9816",
        "datePublished": "2026-08-17T22:05:24.910Z",
        "dateReserved": "2026-05-28T09:54:00.723Z",
        "dateUpdated": "2026-08-17T22:05:24.910Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10080 (GCVE-0-2026-10080)

    Vulnerability from nvd – Published: 2026-08-17 22:04 – Updated: 2026-08-17 22:04
    VLAI
    Title
    Boards plugin panics on WebSocket command with non-string field types
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687
    CWE
    • CWE-704 - Incorrect Type Conversion or Cast
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "alimursaliyev"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-704",
                  "description": "CWE-704: Incorrect Type Conversion or Cast",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:04:30.830Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00687",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00687",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69047"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Boards plugin panics on WebSocket command with non-string field types",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10080",
        "datePublished": "2026-08-17T22:04:30.830Z",
        "dateReserved": "2026-05-29T10:40:50.902Z",
        "dateUpdated": "2026-08-17T22:04:30.830Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16049 (GCVE-0-2026-16049)

    Vulnerability from nvd – Published: 2026-08-17 14:25 – Updated: 2026-08-17 15:26
    VLAI
    Title
    _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
    Summary
    Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 0 , ≤ 10.20.11 (semver)
    Affected: 0 , ≤ 11.5.7 (semver)
    Unaffected: 11.9.0
    Unaffected: 10.11.21
    Unaffected: 11.7.6
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16049",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:08.354829Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:18.140Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "10.20.11",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.5.7",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.6"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "MindFlare007"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost Plugins versions \u003c=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:25:45.816Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00673",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost Plugins to versions 11.9.0, 10.11.21, 11.7.6 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00673",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68836"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16049",
        "datePublished": "2026-08-17T14:25:45.816Z",
        "dateReserved": "2026-07-17T09:46:23.992Z",
        "dateUpdated": "2026-08-17T15:26:18.140Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16048 (GCVE-0-2026-16048)

    Vulnerability from nvd – Published: 2026-08-17 14:22 – Updated: 2026-08-17 15:37
    VLAI
    Title
    Channel member roles accept out-of-scope roles
    Summary
    Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.8.0 , ≤ 11.8.2 (semver)
    Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.8.3
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16048",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:44.352817Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:37:17.479Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.8.2",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.3"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "LePipouDesBois"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.8.x \u003c= 11.8.2, 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:22:43.940Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00697",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.8.3, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00697",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69238"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Channel member roles accept out-of-scope roles",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16048",
        "datePublished": "2026-08-17T14:22:43.940Z",
        "dateReserved": "2026-07-17T09:45:24.899Z",
        "dateUpdated": "2026-08-17T15:37:17.479Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16047 (GCVE-0-2026-16047)

    Vulnerability from nvd – Published: 2026-08-17 14:25 – Updated: 2026-08-17 15:26
    VLAI
    Title
    Board channel linking without read channel permission validation
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16047",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:19.436999Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:34.376Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "GuyNesher"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:25:08.338Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00674",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00674",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68826"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Board channel linking without read channel permission validation",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16047",
        "datePublished": "2026-08-17T14:25:08.338Z",
        "dateReserved": "2026-07-17T09:44:04.187Z",
        "dateUpdated": "2026-08-17T15:26:34.376Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16046 (GCVE-0-2026-16046)

    Vulnerability from nvd – Published: 2026-08-17 14:24 – Updated: 2026-08-17 14:24
    VLAI
    Title
    Missing run-state validation on finished playbook runs
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.5,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:24:14.690Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00675",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00675",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68822"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Missing run-state validation on finished playbook runs",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16046",
        "datePublished": "2026-08-17T14:24:14.690Z",
        "dateReserved": "2026-07-17T09:43:02.018Z",
        "dateUpdated": "2026-08-17T14:24:14.690Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16045 (GCVE-0-2026-16045)

    Vulnerability from nvd – Published: 2026-08-17 14:26 – Updated: 2026-08-17 15:26
    VLAI
    Title
    Delegated OAuth tokens could revoke unrelated OAuth application authorizations
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16045",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:55.419627Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:05.729Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "KennySki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user\u0027s authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 2.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:26:22.724Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00704",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00704",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69395"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Delegated OAuth tokens could revoke unrelated OAuth application authorizations",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16045",
        "datePublished": "2026-08-17T14:26:22.724Z",
        "dateReserved": "2026-07-17T09:41:38.446Z",
        "dateUpdated": "2026-08-17T15:26:05.729Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16044 (GCVE-0-2026-16044)

    Vulnerability from nvd – Published: 2026-08-17 14:26 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Insufficient validation of guest board admin privileges on archive import
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16044",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:45.509454Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:51.740Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:26:52.203Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00672",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00672",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68825"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Insufficient validation of guest board admin privileges on archive import",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16044",
        "datePublished": "2026-08-17T14:26:52.203Z",
        "dateReserved": "2026-07-17T09:40:22.350Z",
        "dateUpdated": "2026-08-17T15:25:51.740Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15754 (GCVE-0-2026-15754)

    Vulnerability from nvd – Published: 2026-08-17 14:36 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15754",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:36.703223Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:38.145Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "KennySki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 11.8.x \u003c= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin\u0027s team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:36:56.282Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00718",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00718",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69800"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-15754",
        "datePublished": "2026-08-17T14:36:56.282Z",
        "dateReserved": "2026-07-14T16:02:49.735Z",
        "dateUpdated": "2026-08-17T15:25:38.145Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10527 (GCVE-0-2026-10527)

    Vulnerability from nvd – Published: 2026-08-17 14:37 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Boards plugin retains Board Admin rights for users demoted to System Guest
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10527",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:26.142171Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:25.134Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fails to reconcile SchemeAdmin flags with a user\u0027s current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:37:46.253Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00691",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00691",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69066"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Boards plugin retains Board Admin rights for users demoted to System Guest",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10527",
        "datePublished": "2026-08-17T14:37:46.253Z",
        "dateReserved": "2026-06-01T10:10:10.052Z",
        "dateUpdated": "2026-08-17T15:25:25.134Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14298 (GCVE-0-2026-14298)

    Vulnerability from nvd – Published: 2026-08-13 08:03 – Updated: 2026-08-13 14:16
    VLAI
    Title
    Denial of service via resource exhaustion in Mattermost
    Summary
    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:16 UTC
    CWE
    • CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.9.0 , ≤ 11.9.0 (semver)
    Affected: 11.8.0 , ≤ 11.8.4 (semver)
    Affected: 11.7.0 , ≤ 11.7.7 (semver)
    Affected: 10.11.0 , ≤ 10.11.22 (semver)
    Unaffected: 11.10.0
    Unaffected: 11.9.1
    Unaffected: 11.8.5
    Unaffected: 11.7.8
    Unaffected: 10.11.23
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14298",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:16:43.935232Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:16:56.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.9.0",
                  "status": "affected",
                  "version": "11.9.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.4",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.7",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.22",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.10.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.1"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.5"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.8"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.23"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Edgar Bellot Mic\u00f3"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-409",
                  "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T08:33:14.345Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00713",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00713",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69604"
            ],
            "discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
          },
          "title": "Denial of service via resource exhaustion in Mattermost",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-14298",
        "datePublished": "2026-08-13T08:03:00.397Z",
        "dateReserved": "2026-07-01T10:07:28.258Z",
        "dateUpdated": "2026-08-13T14:16:56.354Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-7521 (GCVE-0-2026-7521)

    Vulnerability from nvd – Published: 2026-07-28 13:58 – Updated: 2026-07-28 14:48
    VLAI
    Title
    SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory
    Summary
    Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-28 14:47 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.8.0 , ≤ 11.8.0 (semver)
    Affected: 11.7.0 , ≤ 11.7.3 (semver)
    Affected: 11.6.0 , ≤ 11.6.5 (semver)
    Affected: 10.11.0 , ≤ 10.11.20 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.8.1
    Unaffected: 11.7.4
    Unaffected: 11.6.6
    Unaffected: 10.11.21
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-7521",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T14:47:44.026969Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T14:48:13.408Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.8.0",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.3",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.6.5",
                  "status": "affected",
                  "version": "11.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.20",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.1"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.4"
                },
                {
                  "status": "unaffected",
                  "version": "11.6.6"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "winfunc"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.8.x \u003c= 11.8.0, 11.7.x \u003c= 11.7.3, 11.6.x \u003c= 11.6.5, 10.11.x \u003c= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T13:58:31.551Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00666",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.8.1, 11.7.4, 11.6.6, 10.11.21 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00666",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68611"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-7521",
        "datePublished": "2026-07-28T13:58:31.551Z",
        "dateReserved": "2026-04-30T16:51:23.295Z",
        "dateUpdated": "2026-07-28T14:48:13.408Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10819 (GCVE-0-2026-10819)

    Vulnerability from nvd – Published: 2026-07-27 14:15 – Updated: 2026-07-27 15:05
    VLAI
    Title
    Mattermost Server Denial of Service via Animated GIF Emoji Upload
    Summary
    Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-27 15:05 UTC
    CWE
    • CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.6.0 , ≤ 11.6.5 (semver)
    Affected: 10.11.0 , ≤ 10.11.20 (semver)
    Affected: 11.8.0 , ≤ 11.8.1 (semver)
    Affected: 11.7.0 , ≤ 11.7.4 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.6.6
    Unaffected: 10.11.21
    Unaffected: 11.8.2
    Unaffected: 11.7.5
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10819",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-27T15:05:17.249105Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-27T15:05:28.394Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.6.5",
                  "status": "affected",
                  "version": "11.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.20",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.1",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.4",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.6.6"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.2"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.5"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Adam Korczynski"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.6.x \u003c= 11.6.5, 10.11.x \u003c= 10.11.20, 11.8.x \u003c= 11.8.1, 11.7.x \u003c= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-409",
                  "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-27T14:15:25.000Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00695",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.6.6, 10.11.21, 11.8.2, 11.7.5 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00695",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69125"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Mattermost Server Denial of Service via Animated GIF Emoji Upload",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10819",
        "datePublished": "2026-07-27T14:15:25.000Z",
        "dateReserved": "2026-06-04T07:34:33.428Z",
        "dateUpdated": "2026-07-27T15:05:28.394Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10600 (GCVE-0-2026-10600)

    Vulnerability from nvd – Published: 2026-07-27 14:13 – Updated: 2026-07-27 15:04
    VLAI
    Title
    Denial of service via unbounded document content extraction in Mattermost Server
    Summary
    Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-27 15:04 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.8.0 , ≤ 11.8.0 (semver)
    Affected: 11.7.0 , ≤ 11.7.3 (semver)
    Affected: 11.6.0 , ≤ 11.6.5 (semver)
    Affected: 10.11.0 , ≤ 10.11.20 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.8.1
    Unaffected: 11.7.4
    Unaffected: 11.6.6
    Unaffected: 10.11.21
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10600",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-27T15:04:43.406801Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-27T15:04:58.593Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.8.0",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.3",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.6.5",
                  "status": "affected",
                  "version": "11.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.20",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.1"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.4"
                },
                {
                  "status": "unaffected",
                  "version": "11.6.6"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "abderrahimelkahlaoui"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.8.x \u003c= 11.8.0, 11.7.x \u003c= 11.7.3, 11.6.x \u003c= 11.6.5, 10.11.x \u003c= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-27T14:13:29.962Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00694",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.8.1, 11.7.4, 11.6.6, 10.11.21 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00694",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69097"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Denial of service via unbounded document content extraction in Mattermost Server",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10600",
        "datePublished": "2026-07-27T14:13:29.962Z",
        "dateReserved": "2026-06-02T09:04:58.161Z",
        "dateUpdated": "2026-07-27T15:04:58.593Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-75587 (GCVE-0-2026-75587)

    Vulnerability from cvelistv5 – Published: 2026-08-17 22:09 – Updated: 2026-08-17 22:09
    VLAI
    Title
    Plaintext pre-auth secret exposure via Desktop App diagnostics report
    Summary
    Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716
    CWE
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 0 , ≤ 6.2.2 (semver)
    Unaffected: 6.3.0
    Unaffected: 6.2.3.0
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "6.2.2",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "6.3.0"
                },
                {
                  "status": "unaffected",
                  "version": "6.2.3.0"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Juho Fors\u00e9n"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost Desktop App versions \u003c=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user\u0027s diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the Server Connectivity (Step-3) diagnostics output. Mattermost Advisory ID: MMSA-2026-00716"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.6,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:09:49.590Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00716",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost Desktop App to versions 6.3.0, 6.2.3.0 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00716",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69787"
            ],
            "discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
          },
          "title": "Plaintext pre-auth secret exposure via Desktop App diagnostics report",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-75587",
        "datePublished": "2026-08-17T22:09:49.590Z",
        "dateReserved": "2026-08-17T22:07:53.714Z",
        "dateUpdated": "2026-08-17T22:09:49.590Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-9693 (GCVE-0-2026-9693)

    Vulnerability from cvelistv5 – Published: 2026-08-17 22:07 – Updated: 2026-08-17 22:07
    VLAI
    Title
    Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
    Summary
    Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682
    CWE
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 10.11.0 , ≤ 10.11.20 (semver)
    Affected: 11.7.0 , ≤ 11.7.5 (semver)
    Unaffected: 11.9.0
    Unaffected: 10.11.21
    Unaffected: 11.7.6
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "10.11.20",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.5",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.6"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "kiwi_71"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 10.11.x \u003c= 10.11.20, 11.7.x \u003c= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.5,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-459",
                  "description": "CWE-459: Incomplete Cleanup",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:07:12.958Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00682",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 10.11.21, 11.7.6 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00682",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69006"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-9693",
        "datePublished": "2026-08-17T22:07:12.958Z",
        "dateReserved": "2026-05-27T10:58:39.051Z",
        "dateUpdated": "2026-08-17T22:07:12.958Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-9859 (GCVE-0-2026-9859)

    Vulnerability from cvelistv5 – Published: 2026-08-17 22:06 – Updated: 2026-08-17 22:06
    VLAI
    Title
    Mattermost Boards plugin didn’t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-00686
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "kauasilvab14fb3"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request. Mattermost Advisory ID: MMSA-2026-00686"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:06:26.318Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00686",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00686",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69031"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Mattermost Boards plugin didn\u2019t enforce role-based authorization on board channel link allowing board editors to expose boards to arbitrary channels",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-9859",
        "datePublished": "2026-08-17T22:06:26.318Z",
        "dateReserved": "2026-05-28T15:58:29.723Z",
        "dateUpdated": "2026-08-17T22:06:26.318Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-9816 (GCVE-0-2026-9816)

    Vulnerability from cvelistv5 – Published: 2026-08-17 22:05 – Updated: 2026-08-17 22:05
    VLAI
    Title
    Insufficient server-side validation of board member role fields permits privilege escalation
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "kamil-sawicki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:05:24.910Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00685",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00685",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69022"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Insufficient server-side validation of board member role fields permits privilege escalation",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-9816",
        "datePublished": "2026-08-17T22:05:24.910Z",
        "dateReserved": "2026-05-28T09:54:00.723Z",
        "dateUpdated": "2026-08-17T22:05:24.910Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10080 (GCVE-0-2026-10080)

    Vulnerability from cvelistv5 – Published: 2026-08-17 22:04 – Updated: 2026-08-17 22:04
    VLAI
    Title
    Boards plugin panics on WebSocket command with non-string field types
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687
    CWE
    • CWE-704 - Incorrect Type Conversion or Cast
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "alimursaliyev"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-704",
                  "description": "CWE-704: Incorrect Type Conversion or Cast",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T22:04:30.830Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00687",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00687",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69047"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Boards plugin panics on WebSocket command with non-string field types",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10080",
        "datePublished": "2026-08-17T22:04:30.830Z",
        "dateReserved": "2026-05-29T10:40:50.902Z",
        "dateUpdated": "2026-08-17T22:04:30.830Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-10527 (GCVE-0-2026-10527)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:37 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Boards plugin retains Board Admin rights for users demoted to System Guest
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-10527",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:26.142171Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:25.134Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fails to reconcile SchemeAdmin flags with a user\u0027s current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:37:46.253Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00691",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00691",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69066"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Boards plugin retains Board Admin rights for users demoted to System Guest",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-10527",
        "datePublished": "2026-08-17T14:37:46.253Z",
        "dateReserved": "2026-06-01T10:10:10.052Z",
        "dateUpdated": "2026-08-17T15:25:25.134Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-15754 (GCVE-0-2026-15754)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:36 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-15754",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:36.703223Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:38.145Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "KennySki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 11.8.x \u003c= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin\u0027s team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:36:56.282Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00718",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00718",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69800"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-15754",
        "datePublished": "2026-08-17T14:36:56.282Z",
        "dateReserved": "2026-07-14T16:02:49.735Z",
        "dateUpdated": "2026-08-17T15:25:38.145Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16044 (GCVE-0-2026-16044)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:26 – Updated: 2026-08-17 15:25
    VLAI
    Title
    Insufficient validation of guest board admin privileges on archive import
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16044",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:45.509454Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:25:51.740Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:26:52.203Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00672",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00672",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68825"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Insufficient validation of guest board admin privileges on archive import",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16044",
        "datePublished": "2026-08-17T14:26:52.203Z",
        "dateReserved": "2026-07-17T09:40:22.350Z",
        "dateUpdated": "2026-08-17T15:25:51.740Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16045 (GCVE-0-2026-16045)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:26 – Updated: 2026-08-17 15:26
    VLAI
    Title
    Delegated OAuth tokens could revoke unrelated OAuth application authorizations
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:50 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16045",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:50:55.419627Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:05.729Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "KennySki"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user\u0027s authorizations or tokens for other integrations via account-management endpoints.. Mattermost Advisory ID: MMSA-2026-00704"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 2.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:26:22.724Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00704",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00704",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69395"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Delegated OAuth tokens could revoke unrelated OAuth application authorizations",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16045",
        "datePublished": "2026-08-17T14:26:22.724Z",
        "dateReserved": "2026-07-17T09:41:38.446Z",
        "dateUpdated": "2026-08-17T15:26:05.729Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16049 (GCVE-0-2026-16049)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:25 – Updated: 2026-08-17 15:26
    VLAI
    Title
    _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
    Summary
    Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 0 , ≤ 10.20.11 (semver)
    Affected: 0 , ≤ 11.5.7 (semver)
    Unaffected: 11.9.0
    Unaffected: 10.11.21
    Unaffected: 11.7.6
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16049",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:08.354829Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:18.140Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "10.20.11",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.5.7",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.6"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "MindFlare007"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost Plugins versions \u003c=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.9,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:25:45.816Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00673",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost Plugins to versions 11.9.0, 10.11.21, 11.7.6 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00673",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68836"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16049",
        "datePublished": "2026-08-17T14:25:45.816Z",
        "dateReserved": "2026-07-17T09:46:23.992Z",
        "dateUpdated": "2026-08-17T15:26:18.140Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16047 (GCVE-0-2026-16047)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:25 – Updated: 2026-08-17 15:26
    VLAI
    Title
    Board channel linking without read channel permission validation
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Affected: 11.8.0 , ≤ 11.8.3 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Unaffected: 11.8.4
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16047",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:19.436999Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:26:34.376Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.3",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.4"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "GuyNesher"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21, 11.8.x \u003c= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId. Mattermost Advisory ID: MMSA-2026-00674"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:25:08.338Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00674",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, 11.8.4 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00674",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68826"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Board channel linking without read channel permission validation",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16047",
        "datePublished": "2026-08-17T14:25:08.338Z",
        "dateReserved": "2026-07-17T09:44:04.187Z",
        "dateUpdated": "2026-08-17T15:26:34.376Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16046 (GCVE-0-2026-16046)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:24 – Updated: 2026-08-17 14:24
    VLAI
    Title
    Missing run-state validation on finished playbook runs
    Summary
    Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "ilent0"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.5,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:24:14.690Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00675",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00675",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68822"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Missing run-state validation on finished playbook runs",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16046",
        "datePublished": "2026-08-17T14:24:14.690Z",
        "dateReserved": "2026-07-17T09:43:02.018Z",
        "dateUpdated": "2026-08-17T14:24:14.690Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-16048 (GCVE-0-2026-16048)

    Vulnerability from cvelistv5 – Published: 2026-08-17 14:22 – Updated: 2026-08-17 15:37
    VLAI
    Title
    Channel member roles accept out-of-scope roles
    Summary
    Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-17 14:51 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.8.0 , ≤ 11.8.2 (semver)
    Affected: 11.7.0 , ≤ 11.7.6 (semver)
    Affected: 10.11.0 , ≤ 10.11.21 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.8.3
    Unaffected: 11.7.7
    Unaffected: 10.11.22
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-16048",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-17T14:51:44.352817Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-17T15:37:17.479Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.8.2",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.6",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.21",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.3"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.7"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.22"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "LePipouDesBois"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.8.x \u003c= 11.8.2, 11.7.x \u003c= 11.7.6, 10.11.x \u003c= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-863",
                  "description": "CWE-863: Incorrect Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-17T14:22:43.940Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00697",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.8.3, 11.7.7, 10.11.22 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00697",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69238"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Channel member roles accept out-of-scope roles",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-16048",
        "datePublished": "2026-08-17T14:22:43.940Z",
        "dateReserved": "2026-07-17T09:45:24.899Z",
        "dateUpdated": "2026-08-17T15:37:17.479Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-14298 (GCVE-0-2026-14298)

    Vulnerability from cvelistv5 – Published: 2026-08-13 08:03 – Updated: 2026-08-13 14:16
    VLAI
    Title
    Denial of service via resource exhaustion in Mattermost
    Summary
    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:16 UTC
    CWE
    • CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.9.0 , ≤ 11.9.0 (semver)
    Affected: 11.8.0 , ≤ 11.8.4 (semver)
    Affected: 11.7.0 , ≤ 11.7.7 (semver)
    Affected: 10.11.0 , ≤ 10.11.22 (semver)
    Unaffected: 11.10.0
    Unaffected: 11.9.1
    Unaffected: 11.8.5
    Unaffected: 11.7.8
    Unaffected: 10.11.23
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-14298",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:16:43.935232Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:16:56.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.9.0",
                  "status": "affected",
                  "version": "11.9.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.8.4",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.7",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.22",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.10.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.1"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.5"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.8"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.23"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Edgar Bellot Mic\u00f3"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-409",
                  "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T08:33:14.345Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00713",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.10.0, 11.9.1, 11.8.5, 11.7.8, 10.11.23 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00713",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-69604"
            ],
            "discovery": "{\"self\"=\u003e\"https://mattermost.atlassian.net/rest/api/2/customFieldOption/10557\", \"value\"=\u003e\"Internal\", \"id\"=\u003e\"10557\"}"
          },
          "title": "Denial of service via resource exhaustion in Mattermost",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-14298",
        "datePublished": "2026-08-13T08:03:00.397Z",
        "dateReserved": "2026-07-01T10:07:28.258Z",
        "dateUpdated": "2026-08-13T14:16:56.354Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-7521 (GCVE-0-2026-7521)

    Vulnerability from cvelistv5 – Published: 2026-07-28 13:58 – Updated: 2026-07-28 14:48
    VLAI
    Title
    SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory
    Summary
    Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-28 14:47 UTC
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    URL Tags
    https://mattermost.com/security-updates vendor-advisory
    Impacted products
    Vendor Product Version
    Mattermost Mattermost Affected: 11.8.0 , ≤ 11.8.0 (semver)
    Affected: 11.7.0 , ≤ 11.7.3 (semver)
    Affected: 11.6.0 , ≤ 11.6.5 (semver)
    Affected: 10.11.0 , ≤ 10.11.20 (semver)
    Unaffected: 11.9.0
    Unaffected: 11.8.1
    Unaffected: 11.7.4
    Unaffected: 11.6.6
    Unaffected: 10.11.21
    Create a notification for this product.
    Credits
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-7521",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T14:47:44.026969Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T14:48:13.408Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Mattermost",
              "vendor": "Mattermost",
              "versions": [
                {
                  "lessThanOrEqual": "11.8.0",
                  "status": "affected",
                  "version": "11.8.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.7.3",
                  "status": "affected",
                  "version": "11.7.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "11.6.5",
                  "status": "affected",
                  "version": "11.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "10.11.20",
                  "status": "affected",
                  "version": "10.11.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "11.9.0"
                },
                {
                  "status": "unaffected",
                  "version": "11.8.1"
                },
                {
                  "status": "unaffected",
                  "version": "11.7.4"
                },
                {
                  "status": "unaffected",
                  "version": "11.6.6"
                },
                {
                  "status": "unaffected",
                  "version": "10.11.21"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "winfunc"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Mattermost versions 11.8.x \u003c= 11.8.0, 11.7.x \u003c= 11.7.3, 11.6.x \u003c= 11.6.5, 10.11.x \u003c= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint.. Mattermost Advisory ID: MMSA-2026-00666"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T13:58:31.551Z",
            "orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
            "shortName": "Mattermost"
          },
          "references": [
            {
              "name": "MMSA-2026-00666",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://mattermost.com/security-updates"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Update Mattermost to versions 11.9.0, 11.8.1, 11.7.4, 11.6.6, 10.11.21 or higher."
            }
          ],
          "source": {
            "advisory": "MMSA-2026-00666",
            "defect": [
              "https://mattermost.atlassian.net/browse/MM-68611"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee",
        "assignerShortName": "Mattermost",
        "cveId": "CVE-2026-7521",
        "datePublished": "2026-07-28T13:58:31.551Z",
        "dateReserved": "2026-04-30T16:51:23.295Z",
        "dateUpdated": "2026-07-28T14:48:13.408Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }