What is the CVSS score of CVE-2026-4858?

CVE-2026-4858 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-4858?

Mattermost collaboration platform versions 11.6.x, 11.5.x, 11.4.x, and 10.11.x contain a privilege escalation vulnerability requiring authenticated user access to invoke system administrator API…. A patch is available.

How to fix or mitigate CVE-2026-4858?

24 hours: Inventory Mattermost instances for affected versions (11.6.x, 11.5.x, 11.4.x, 10.11.x) and document authenticated user base with integration access. 7 days: Restrict integration creation and modification privileges to trusted administrator accounts; implement monitoring and alerts for admin API invocations; subscribe to Mattermost security advisories for patch notification. 30 days: Apply vendor patch immediately upon release and validate through controlled testing before production deployment.

Mattermost CVE-2026-4858

EUVD-2026-31242 HIGH

Path Traversal (CWE-22)

2026-05-21 Mattermost

GHSA-c4r7-j7pp-r8mp

Path Traversal Mattermost

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 09:30 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

AnalysisAI

Privilege escalation via path traversal in Mattermost collaboration platform allows authenticated users to invoke arbitrary internal APIs using the system administrator's auth token by manipulating integration action URLs. Affected branches include 11.6.x, 11.5.x, 11.4.x, and 10.11.x, with no public exploit identified at time of analysis. CVSS 8.0 reflects high impact across confidentiality, integrity, and availability despite high attack complexity and required user interaction.

Technical ContextAI

Mattermost is an open-source, self-hostable team messaging and collaboration platform widely deployed as a Slack alternative in enterprises and government environments. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e., Path Traversal): the integration action URL handler does not normalize or validate the path component of URLs supplied by integrations, so sequences such as '../' permit redirection of the request to arbitrary API endpoints. Because the server processes those redirected requests using the system administrator's stored auth token (used for executing integration actions), the traversal effectively launders a low-privileged user's request into a privileged internal API call. The CPE 'cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*' covers all Mattermost server editions in the listed version ranges.

RemediationAI

Patch available per vendor advisory MMSA-2026-00640 at https://mattermost.com/security-updates; administrators should upgrade to the next maintenance release on their branch above the listed vulnerable ceilings (11.6.x > 11.6.0, 11.5.x > 11.5.3, 11.4.x > 11.4.4, 10.11.x > 10.11.14) - consult the advisory for the exact fix versions, as released patched versions are not independently confirmed in the available data. Until patches are deployed, compensating controls include restricting who can create or modify integrations and slash commands via Mattermost system console permissions (trade-off: blocks legitimate integration development), auditing existing integrations for unexpected action URL patterns containing '../' or encoded traversal sequences, rotating the system admin auth token after upgrade, and placing the Mattermost API behind a reverse proxy that normalizes and rejects path-traversal sequences before they reach the integration handler (trade-off: may break legitimate redirect-style integrations).