What is the CVSS score of CVE-2026-28741?

CVE-2026-28741 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28741?

Yes, a patch is available for CVE-2026-28741. Update the affected software to the latest version immediately.

Mattermost CVE-2026-28741

Q: Which versions of Mattermost are affected by CVE-2026-28741?

Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to validate CSRF tokens on authentication endpoints, allowing remote attackers to update a…. A patch is available.

EUVD-2026-22875 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-15 Mattermost

CSRF Mattermost

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 10:56 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22875

Analysis Generated

Apr 15, 2026 - 10:45 vuln.today

CVE Published

Apr 15, 2026 - 10:13 nvd

MEDIUM 6.8

DescriptionCVE.org

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625

AnalysisAI

Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to validate CSRF tokens on authentication endpoints, allowing remote attackers to update a targeted user's authentication method by tricking them into visiting a malicious page. The attack requires user interaction (UI:R) and results in high confidentiality and integrity impact, but no public exploit or CISA KEV confirmation has been identified at the time of analysis.

Technical ContextAI

The vulnerability stems from improper implementation of Cross-Site Request Forgery (CWE-352) protections on Mattermost's authentication endpoints. CSRF tokens are cryptographic values that validate that state-changing requests originate from legitimate, authenticated sessions rather than attacker-controlled sources. When Mattermost fails to validate these tokens on authentication modification endpoints, an attacker can craft a malicious webpage that, when visited by an authenticated user, silently submits a forged request to change that user's authentication method (such as switching to a different authentication provider or resetting credentials). This affects the Mattermost open-source collaboration platform (cpe:2.3:a:mattermost:mattermost) across multiple minor versions, indicating a regression or oversight in security controls across a release branch.

RemediationAI

Upgrade to Mattermost versions 10.11.13 or later (for the 10.11.x line), 11.3.3 or later (for the 11.3.x line), 11.4.3 or later (for the 11.4.x line), or 11.5.1 or later (for the 11.5.x line). These patched releases include proper CSRF token validation on all authentication endpoints. Administrators should apply updates promptly, particularly for instances where user authentication methods can be changed via web interface. For deployment environments where immediate patching is not feasible, consider restricting access to authentication configuration endpoints via network-level controls or reverse proxy rules. Full remediation details and advisory information are available at https://mattermost.com/security-updates (Mattermost Advisory ID: MMSA-2026-00625).