What is the CVSS score of CVE-2026-27659?

CVE-2026-27659 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-27659?

CVE-2026-27659 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 4.6. Users could be tricked into performing unintended actions.. A patch is available.

How to fix or mitigate CVE-2026-27659?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Mattermost CVE-2026-27659

EUVD-2026-15806 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-25 Mattermost

GHSA-rmhw-c3xr-m3xx

CSRF Mattermost

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15806

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:33 nvd

MEDIUM 4.6

DescriptionCVE.org

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578

AnalysisAI

A Cross-Site Request Forgery (CSRF) vulnerability exists in Mattermost's access control policy activation endpoint due to improper CSRF token validation. Authenticated attackers can exploit this to trick administrators into activating or deactivating access control policies via crafted requests, potentially altering security posture. The vulnerability affects Mattermost versions 10.11.x through 10.11.10, 11.2.x through 11.2.2, 11.3.x through 11.3.1, and 11.4.0. No public exploitation or active KEV status has been reported, though the CISA SSVC framework indicates no current exploitation evidence and non-automatable attack requirements, limiting immediate real-world threat severity.

Technical ContextAI

The vulnerability stems from inadequate CSRF token validation in the /api/v4/access_control_policies/{policy_id}/activate REST API endpoint (CWE-352: Cross-Site Request Forgery). CSRF protections are critical in web applications to ensure state-changing operations originate from legitimate user sessions rather than attacker-controlled sites. Mattermost, identified via CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, implements role-based access control via policies; the activate endpoint controls whether these policies are enforced organization-wide. When CSRF tokens are not properly validated or are missing from the request validation logic, an attacker can craft malicious HTML or JavaScript that, when visited by an authenticated admin, will submit requests to toggle policy states without the admin's knowledge or consent.

RemediationAI

Immediately upgrade Mattermost to patched versions beyond 11.2.2, 10.11.10, 11.3.1, and 11.4.0, respectively—consult https://mattermost.com/security-updates for exact patched release versions in your release branch. Until patches can be applied, implement compensating controls: enforce HTTPS-only connections with HSTS headers, restrict admin console access to internal networks only via firewall rules, and educate administrators to avoid visiting untrusted links while logged into Mattermost. Consider temporarily disabling access control policy modification APIs via web application firewall rules if policies are not actively modified.