EUVD-2026-15806
GHSA-rmhw-c3xr-m3xx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578
AnalysisAI
A Cross-Site Request Forgery (CSRF) vulnerability exists in Mattermost's access control policy activation endpoint due to improper CSRF token validation. Authenticated attackers can exploit this to trick administrators into activating or deactivating access control policies via crafted requests, potentially altering security posture. The vulnerability affects Mattermost versions 10.11.x through 10.11.10, 11.2.x through 11.2.2, 11.3.x through 11.3.1, and 11.4.0. No public exploitation or active KEV status has been reported, though the CISA SSVC framework indicates no current exploitation evidence and non-automatable attack requirements, limiting immediate real-world threat severity.
Technical ContextAI
The vulnerability stems from inadequate CSRF token validation in the /api/v4/access_control_policies/{policy_id}/activate REST API endpoint (CWE-352: Cross-Site Request Forgery). CSRF protections are critical in web applications to ensure state-changing operations originate from legitimate user sessions rather than attacker-controlled sites. Mattermost, identified via CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, implements role-based access control via policies; the activate endpoint controls whether these policies are enforced organization-wide. When CSRF tokens are not properly validated or are missing from the request validation logic, an attacker can craft malicious HTML or JavaScript that, when visited by an authenticated admin, will submit requests to toggle policy states without the admin's knowledge or consent.
RemediationAI
Immediately upgrade Mattermost to patched versions beyond 11.2.2, 10.11.10, 11.3.1, and 11.4.0, respectively—consult https://mattermost.com/security-updates for exact patched release versions in your release branch. Until patches can be applied, implement compensating controls: enforce HTTPS-only connections with HSTS headers, restrict admin console access to internal networks only via firewall rules, and educate administrators to avoid visiting untrusted links while logged into Mattermost. Consider temporarily disabling access control policy modification APIs via web application firewall rules if policies are not actively modified.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today