DeutschShown in its original language — a full translation is planned for a future version.
Mattermost: Mehrere Schwachstellen
view advisory published 2026-10-15
Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-19621US | — | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-de… | ||||
| CVE-2026-19600US | medium4.9 | — | ||
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, whic… | ||||
| CVE-2026-19076US | medium4.9OT elevated | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint, which al… | ||||
| CVE-2026-18799US | —OT elevated | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports… | ||||
| CVE-2026-18560US | — | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content r… | ||||
| CVE-2026-18256US | —OT elevated | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows a… | ||||
| CVE-2026-16453US | — | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an auth… | ||||
| CVE-2026-16251US | — | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image… | ||||
| CVE-2026-19867US | — | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notification proper… | ||||
| CVE-2026-19603US | — | — | ||
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, w… | ||||
| CVE-2026-19601US | — | — | ||
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (su… | ||||
| CVE-2026-19541US | — | — | ||
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth… | ||||
| CVE-2026-18795US | —OT elevated | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quaran… | ||||
| CVE-2026-18551US | —OT elevated | — | ||
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authen… | ||||
02
references
External citations — patches, advisories, analysis.
- EU Vulnerability Database EUVD-2026-102742 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102743 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102744 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102745 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102746 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102747 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102749 vom 2026-10-15external
- EU Vulnerability Database EUVD-2026-102750 vom 2026-10-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan