What is the CVSS score of CVE-2026-4858?

CVE-2026-4858 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-4858?

Mattermost collaboration platform versions 11.6.x, 11.5.x, 11.4.x, and 10.11.x contain a privilege escalation vulnerability requiring authenticated user access to invoke system administrator API…

Mattermost CVE-2026-4858

Q: How to fix or mitigate CVE-2026-4858?

24 hours: Inventory Mattermost instances for affected versions (11.6.x, 11.5.x, 11.4.x, 10.11.x) and document authenticated user base with integration access. 7 days: Restrict integration creation and modification privileges to trusted administrator accounts; implement monitoring and alerts for admin API invocations; subscribe to Mattermost security advisories for patch notification. 30 days: Apply vendor patch immediately upon release and validate through controlled testing before production deployment.

EUVD-2026-31242 HIGH

Path Traversal (CWE-22)

2026-05-21 Mattermost

GHSA-c4r7-j7pp-r8mp

Path Traversal Mattermost

8.0

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 09:30 vuln.today

DescriptionNVD

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

AnalysisAI

Privilege escalation via path traversal in Mattermost collaboration platform allows authenticated users to invoke arbitrary internal APIs using the system administrator's auth token by manipulating integration action URLs. Affected branches include 11.6.x, 11.5.x, 11.4.x, and 10.11.x, with no public exploit identified at time of analysis. …

RemediationAI

24 hours: Inventory Mattermost instances for affected versions (11.6.x, 11.5.x, 11.4.x, 10.11.x) and document authenticated user base with integration access. 7 days: Restrict integration creation and modification privileges to trusted administrator accounts; implement monitoring and alerts for admin API invocations; subscribe to Mattermost security advisories for patch notification. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-4858 vulnerability details – vuln.today

Back

Mattermost CVE-2026-4858

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code