EUVD-2026-22875Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625
AnalysisAI
Mattermost versions 10.11.x through 10.11.12, 11.3.x through 11.3.2, 11.4.x through 11.4.2, and 11.5.0 fail to validate CSRF tokens on authentication endpoints, allowing remote attackers to update a targeted user's authentication method by tricking them into visiting a malicious page. The attack requires user interaction (UI:R) and results in high confidentiality and integrity impact, but no public exploit or CISA KEV confirmation has been identified at the time of analysis.
Technical ContextAI
The vulnerability stems from improper implementation of Cross-Site Request Forgery (CWE-352) protections on Mattermost's authentication endpoints. CSRF tokens are cryptographic values that validate that state-changing requests originate from legitimate, authenticated sessions rather than attacker-controlled sources. When Mattermost fails to validate these tokens on authentication modification endpoints, an attacker can craft a malicious webpage that, when visited by an authenticated user, silently submits a forged request to change that user's authentication method (such as switching to a different authentication provider or resetting credentials). This affects the Mattermost open-source collaboration platform (cpe:2.3:a:mattermost:mattermost) across multiple minor versions, indicating a regression or oversight in security controls across a release branch.
RemediationAI
Upgrade to Mattermost versions 10.11.13 or later (for the 10.11.x line), 11.3.3 or later (for the 11.3.x line), 11.4.3 or later (for the 11.4.x line), or 11.5.1 or later (for the 11.5.x line). These patched releases include proper CSRF token validation on all authentication endpoints. Administrators should apply updates promptly, particularly for instances where user authentication methods can be changed via web interface. For deployment environments where immediate patching is not feasible, consider restricting access to authentication configuration endpoints via network-level controls or reverse proxy rules. Full remediation details and advisory information are available at https://mattermost.com/security-updates (Mattermost Advisory ID: MMSA-2026-00625).
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today