What is the CVSS score of CVE-2026-27656?

CVE-2026-27656 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-27656?

CVE-2026-27656 presents moderate security risk rated CVSS 5.7. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-27656?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost CVE-2026-27656

EUVD-2026-15805 MEDIUM

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-03-25 Mattermost

GHSA-fg35-5rf6-qg3g

Information Disclosure Mattermost

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15805

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:28 nvd

MEDIUM 5.7

DescriptionCVE.org

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590

AnalysisAI

Mattermost fails to properly validate user identity in OpenID Connect authentication logic due to an overly permissive substring matching flaw in the IsSameUser() comparison function, allowing attackers with high privileges to take over arbitrary user accounts through the user discovery flow. This affects Mattermost versions 10.11.0-10.11.11, 11.2.0-11.2.3, 11.3.0-11.3.1, and 11.4.0. While the CVSS score of 5.7 is moderate and requires high privilege access and user interaction, the core impact is account takeover with full account compromise possible.

Technical ContextAI

The vulnerability resides in Mattermost's OpenID Connect (OIDC) authentication handler, specifically within the identity validation logic that compares user identities during SSO flows. The affected component uses a substring matching comparison rather than strict equality checking in the IsSameUser() function, which violates CWE-303 (Incorrect Implementation of Authentication Algorithm). The CPE string cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* indicates the core Mattermost application is vulnerable across multiple major and minor versions. The vulnerability exists in the user discovery mechanism that processes OpenID claims, allowing attackers to craft requests that partially match legitimate user identifiers and bypass identity verification controls.

RemediationAI

Immediately upgrade Mattermost to patched versions: 10.11.12 or later for the 10.11.x line, 11.2.4 or later for the 11.2.x line, 11.3.2 or later for the 11.3.x line, and 11.4.1 or later for the 11.4.x line. The primary fix involves correcting the IsSameUser() comparison logic to use strict equality matching rather than substring matching. Until patches can be deployed, restrict OpenID Connect authentication to trusted identity providers and limit administrative access to SSO configuration. Review OIDC claims and user discovery API logs for anomalous patterns indicating exploitation attempts. Consider temporarily disabling OpenID authentication in non-production environments until patching is complete. Consult the Mattermost security advisory at https://mattermost.com/security-updates for detailed guidance.