Mattermost CVE-2026-4858

The attacker must hold a valid authenticated Mattermost account (PR:L) and must be able to reach the integration action functionality - specifically the ability to craft or trigger an integration action URL containing path-traversal sequences. No user interaction is required (UI:N) and no non-default feature toggle is documented as necessary beyond the presence of the integration action mechanism. The primary limiting factor is authentication: an anonymous, unauthenticated attacker cannot exploit this. Exploitation succeeds against the listed vulnerable versions (11.6.0 and earlier, 11.5.3 and earlier, 11.4.4 and earlier, 10.11.14 and earlier) and hinges on the server dispatching the traversed request with the system admin auth token.

The signals are mixed and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:H) scores 9.9 because a low-privileged, authenticated network attacker with no user interaction can escalate to a scope-changing, total-impact compromise - consistent with CISA SSVC rating Technical Impact as 'total'. However, SSVC also rates Exploitation as 'none' and Automatable as 'no', and EPSS is only 0.03% (9th percentile), indicating no observed exploitation and low predicted near-term exploitation volume. This is a genuinely high-severity issue by impact, but it is not currently being exploited and requires a valid authenticated account, so it is best treated as a high-priority patch for internet-facing or multi-tenant Mattermost deployments rather than an emergency 'exploited-in-the-wild' scenario. The key limiting factor - PR:L, i.e. the attacker must already hold a valid low-privilege account - is not reflected in raw severity and should temper prioritization for instances with tightly controlled, trusted user bases.

A low-privileged authenticated user creates or triggers an integration action whose callback URL contains path-traversal sequences; when the Mattermost server processes the action it attaches the system administrator's auth token and the traversal redirects the request to a privileged internal API endpoint, executing it with admin rights. The attacker uses this to, for example, promote their own account to system admin or exfiltrate configuration and data. No public exploit is identified at time of analysis, and the low CVSS attack complexity (AC:L) means the traversal payload is straightforward once account access is obtained.