What is the CVSS score of CVE-2026-3495?

CVE-2026-3495 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3495?

Yes, a patch is available for CVE-2026-3495. Update the affected software to the latest version immediately.

Mattermost CVE-2026-3495

Q: Which versions of Mattermost are affected by CVE-2026-3495?

Cross-site scripting (XSS) in Mattermost Server 10.11.0-10.11.13 and 11.5.0-11.5.1 enables authenticated administrators to inject JavaScript code through unescaped variables in error page templates.. A patch is available.

EUVD-2026-30742 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-18 Mattermost

GHSA-jx93-pf6x-874r

Mattermost XSS

3.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:15 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622

AnalysisAI

Cross-site scripting (XSS) in Mattermost Server 10.11.0-10.11.13 and 11.5.0-11.5.1 enables authenticated administrators to inject JavaScript code through unescaped variables in error page templates. Exploitation requires high-privilege (PR:H) administrative access to site configuration settings, limiting real-world risk despite network-based attack vector (AV:N). No active exploitation confirmed (not in CISA KEV). EPSS data not available for recent CVE. This is a stored XSS vulnerability affecting administrative workflows rather than end users.

Technical ContextAI

This vulnerability stems from improper neutralization of input during web page generation (CWE-79). Mattermost's error page composition logic fails to sanitize certain configuration variables before rendering them in HTML responses. When an administrator edits specific site configuration fields (exact fields not disclosed in available data), the application stores and later displays these values without proper output encoding. The affected component processes these values server-side during error condition handling, allowing injected JavaScript to execute in the context of users viewing error pages. The CPE identifier confirms impact to Mattermost server deployments across the specified version ranges, with no platform-specific restrictions noted.

RemediationAI

Upgrade to Mattermost Server version 10.11.14 or later for the 10.11.x branch, or version 11.5.2 or later for the 11.5.x branch (exact patched versions inferred from vulnerable range endpoints but not independently verified from available data). Consult the official Mattermost security advisory at https://mattermost.com/security-updates for confirmed fix versions and upgrade instructions. If immediate patching is not feasible, implement compensating controls: restrict administrative access to the site configuration interface using role-based access controls, enable multi-factor authentication for all administrator accounts, monitor audit logs for unexpected configuration changes to error-handling related settings, and consider implementing Content Security Policy headers to mitigate JavaScript execution risks (note: CSP may interfere with legitimate Mattermost functionality and requires testing). These workarounds reduce but do not eliminate risk as the underlying input validation flaw remains.