What is the CVSS score of CVE-2026-3117?

CVE-2026-3117 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Mattermost Plugins CVE-2026-3117

Q: Which versions of Mattermost Plugins are affected by CVE-2026-3117?

{option}` or `/gitlab webhook {option}`, resulting in availability impact (A:H) to the Gitlab plugin infrastructure.

EUVD-2026-30748 MEDIUM

Missing Authorization (CWE-862)

2026-05-18 Mattermost

GHSA-5gjv-5xhr-vc35

Mattermost Authentication Bypass Gitlab

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:32 vuln.today

DescriptionCVE.org

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}} or the {{/gitlab webhook {option}}} commands. Mattermost Advisory ID: MMSA-2026-00600

AnalysisAI

Authenticated users in Mattermost Plugins can disrupt Gitlab integration by uninstalling instances or modifying webhook connections without proper authorization. The CWE-862 authorization flaw in versions <=11.5, 11.1.5, 10.13.11, and 11.3.4.0 allows users with low-level privileges (PR:L) to execute administrative commands via /gitlab instance {option} or /gitlab webhook {option}, resulting in availability impact (A:H) to the Gitlab plugin infrastructure. CVSS 6.5 reflects moderate risk, with EPSS data and active exploitation status not available at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), where the Mattermost Plugins Gitlab integration fails to enforce role-based access controls on administrative command handlers. The affected CPE (cpe:2.3:a:mattermost:mattermost) indicates core Mattermost server plugin infrastructure. The slash command parser processes /gitlab instance and /gitlab webhook commands without validating that the invoking user possesses administrative privileges required for instance management or webhook configuration. This represents a broken access control pattern where authentication (PR:L confirms users must be logged in) is present but authorization checks are absent, allowing privilege escalation from normal user to plugin administrator within the Gitlab integration context.

RemediationAI

Upgrade Mattermost to the latest patched version as specified in vendor advisory MMSA-2026-00600 at https://mattermost.com/security-updates. The advisory should contain exact fixed versions for the 11.x, 10.x, and 11.3.x release branches. If immediate patching is not feasible, implement compensating controls: disable the Gitlab plugin entirely via System Console > Plugins > Management until patches can be applied (trade-off: loss of Gitlab integration functionality), or restrict plugin command execution through Mattermost's slash command permissions if available in your version (verify support in your specific release). For high-security environments, audit Mattermost logs for unauthorized /gitlab instance or /gitlab webhook command usage by non-administrative users to detect potential exploitation. Review and rotate Gitlab webhook secrets after patching if unauthorized webhook modifications are suspected.