EUVD-2026-31242
GHSA-c4r7-j7pp-r8mp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated low-priv user (PR:L) over the network with low complexity uses the admin token to cross authority (S:C), yielding total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640
AnalysisAI
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the 11.6.x line, 11.5.3 and earlier, 11.4.4 and earlier, and 10.11.14 and earlier) allows a low-privileged authenticated user to abuse missing path-traversal validation on integration action URLs to invoke arbitrary internal APIs using the system administrator's Mattermost auth token. Because the request is executed with the admin token, the attacker effectively gains total control over the instance despite starting as an ordinary user. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the vendor-assigned CVSS of 9.9 reflects the severe privilege-crossing impact.
Technical ContextAI
Mattermost is an open-source, self-hostable team collaboration and messaging platform (a common Slack alternative) that supports integrations and interactive message actions which call back to configured URLs. The flaw is a CWE-22 Path Traversal: the integration action URL is not sanitized against traversal sequences, so a crafted URL can escape its intended scope and be routed to internal API endpoints. Critically, the server dispatches these integration action requests using the system administrator's Mattermost auth token, so a traversal that redirects the call to an arbitrary API endpoint executes that call with full admin authority. The affected component per CPE is cpe:2.3:a:mattermost:mattermost across all listed version branches.
RemediationAI
Patch available per vendor advisory - upgrade to the fixed release for your branch as published at the Mattermost security updates page (https://mattermost.com/security-updates); the exact fixed build should be taken from that advisory (MMSA-2026-00640) since a specific fix version is not present in the available data and must not be invented. Because exploitation requires an authenticated account, effective compensating controls until patching include restricting who can create or configure integrations/slash commands and interactive message actions (limit integration-creation permissions to trusted administrators), auditing existing integration action URLs for traversal sequences, and tightening account provisioning so untrusted users cannot obtain login access; the trade-off is reduced integration self-service for regular users. Placing the server behind SSO/network access controls further limits the pool of potential authenticated attackers, at the cost of added access friction.
More in Mattermost
View allDenial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today