EUVD-2026-31430
GHSA-rmvv-8v8w-rf7x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.. Mattermost Advisory ID: MMSA-2026-00638
AnalysisAI
Authenticated denial-of-service in Mattermost's plugin subsystem allows a low-privileged user to crash the plugin process by sending a crafted HTTP request to the PR details API endpoint. Affected across four active release branches (10.11.x, 11.4.x, 11.5.x, 11.6.x), the flaw stems from missing input validation in API request handlers (CWE-1287). No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the low authentication barrier (any valid account) combined with network accessibility makes it a realistic insider or post-compromise nuisance risk.
Technical ContextAI
The root cause is CWE-1287 (Improper Validation of Specified Type of Input): Mattermost's API request handlers for the PR details endpoint accept user-controlled data without enforcing expected type or structure constraints, allowing a malformed payload to reach the plugin runtime in an unexpected state and trigger a process crash. The affected component is the Mattermost server application (CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*), specifically the plugin management layer that exposes a PR (pull request) details endpoint - indicative of an integration plugin (e.g., GitHub or GitLab connector). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L confirms a network-reachable attack of low complexity, requiring only a standard authenticated session, with impact scoped to availability at a limited (plugin-process) level rather than the full Mattermost service. Advisory reference MMSA-2026-00638 and ENISA EUVD-2026-31430 corroborate the vendor-reported scope.
RemediationAI
Upgrade Mattermost to a version beyond the affected ranges per the vendor advisory at https://mattermost.com/security-updates. The advisory covers patched releases across all affected branches (10.11.x, 11.4.x, 11.5.x, 11.6.x), but exact fixed version numbers are not explicitly stated in the available intelligence data - consult the vendor advisory directly to confirm the minimum safe version for each branch. If immediate upgrade is not feasible, a compensating control is to restrict API access to the PR details endpoint at the network or reverse-proxy layer, limiting it to trusted internal IP ranges; note this may break legitimate integrations relying on that endpoint. Additionally, enforcing strict user account hygiene (disabling dormant accounts, auditing who holds active sessions) reduces the pool of potential authenticators who could abuse the flaw.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today