What is the CVSS score of CVE-2026-2462?

CVE-2026-2462 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Mattermost are affected by CVE-2026-2462?

CVE-2026-2462 presents notable security risk, a incorrect authorization vulnerability rated CVSS 6.6. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-2462?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost CVE-2026-2462

EUVD-2026-12413 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-16 Mattermost

RCE Authentication Bypass Mattermost

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 13:00 euvd

EUVD-2026-12413

Analysis Generated

Mar 16, 2026 - 13:00 vuln.today

CVE Published

Mar 16, 2026 - 12:00 nvd

MEDIUM 6.6

DescriptionCVE.org

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528

AnalysisAI

This vulnerability in Mattermost allows unauthenticated attackers to achieve remote code execution and exfiltrate sensitive credentials through malicious plugin installation on CI test instances that retain default admin credentials. Affected versions include Mattermost 10.11.x through 10.11.10, 11.2.x through 11.2.2, and 11.3.0, with the core issue stemming from insufficient access controls on plugin installation combined with default credential exposure. An attacker can upload a malicious plugin after modifying the import directory to gain full system compromise and access AWS and SMTP credentials stored in configuration files.

Technical ContextAI

The vulnerability exploits a failure in authorization controls (CWE-863: Incorrect Authorization) within Mattermost's plugin installation mechanism. Mattermost is a self-hosted team collaboration platform (identified via CPE cpe:2.3:a:mattermost:mattermost) that allows administrators to extend functionality through plugins. The root cause involves two compounding factors: first, CI test instances are deployed with default administrative credentials that remain unchanged in production-like configurations, and second, the plugin installation endpoint does not properly enforce authentication or authorization checks before allowing plugin uploads. An attacker with network access can change the plugin import directory path and upload arbitrary plugin files containing malicious code, which are then executed with the privileges of the Mattermost application server. This allows both arbitrary code execution on the host system and access to sensitive configuration data including database credentials, AWS API keys, and SMTP authentication tokens typically stored in plaintext configuration files accessible to the application process.

RemediationAI

Immediately upgrade affected Mattermost instances to patched versions beyond 10.11.10, 11.2.2, and 11.3.0 as specified in the vendor advisory at https://mattermost.com/security-updates. As a critical interim measure before patching, change all default administrative credentials immediately and enforce strong, unique passwords for all administrative accounts. Additionally, restrict network access to Mattermost instances to trusted IP ranges or VPN-only connectivity, disable plugin installation if not required for operations, and remove or restrict the ability to modify plugin import directories through configuration hardening. Review plugin installation logs and audit any plugins installed during the exposure window for signs of compromise. For CI/test instances specifically, implement separate credential management and avoid deploying test instances with production-like configurations or credentials. Monitor sensitive configuration files for unauthorized access and rotate all credentials stored in Mattermost configuration (AWS keys, SMTP passwords, database credentials) as a precautionary measure.