What is the CVSS score of CVE-2026-5139?

CVE-2026-5139 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-5139

EUVD-2026-38246 MEDIUM

Missing Authorization (CWE-862)

2026-06-22 Mattermost

GHSA-2g8v-grq3-hq2g

Authentication Bypass Gitlab Mattermost

5.4

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable slash command with no special configuration needed, but requires an authenticated session (PR:L); global config overwrite yields low integrity and availability impact with no confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 14:41 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect <instance-name>}} slash command.. Mattermost Advisory ID: MMSA-2026-00644

AnalysisAI

The /gitlab connect slash command in Mattermost fails to enforce administrator-level authorization on the setDefaultInstance call, enabling any authenticated user to overwrite the workspace-wide default GitLab instance configuration. Affected across four concurrent release trains (11.7.0, 11.6.x ≤ 11.6.2, 11.5.x ≤ 11.5.5, 10.11.x ≤ 10.11.17), this missing authorization flaw (CWE-862) is exploitable by any valid Mattermost account holder without elevated privileges. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and low privilege requirement make this accessible to any workspace member targeting GitLab integration infrastructure.

Technical ContextAI

Mattermost is an open-source team messaging platform supporting slash commands for third-party integrations. The /gitlab plugin exposes a connect command with a setDefaultInstance handler designed to allow administrators to define the workspace-wide default GitLab endpoint. CWE-862 (Missing Authorization) is the root cause: the application performs a privileged, globally scoped configuration write without verifying that the invoking principal holds an administrative role. Because the overwritten setting is global, it affects all users and services relying on the GitLab integration across the entire Mattermost instance - not just the invoking user's session. The CPE string cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* confirms this affects the Mattermost server application directly, not a separately packaged plugin component.

RemediationAI

Upgrade to a patched Mattermost release per advisory MMSA-2026-00644; consult https://mattermost.com/security-updates for the exact fix version in each affected release train, as precise patched version numbers were not independently confirmed in the available data beyond the advisory reference. As a compensating control pending upgrade, administrators can disable the GitLab plugin entirely via the Mattermost System Console if GitLab integration is not actively required - this eliminates the vulnerable command surface at the cost of all /gitlab slash command functionality. If the integration must remain active, restricting slash command usage to specific trusted channels or limiting channel membership reduces the pool of users who can invoke /gitlab connect, though this does not eliminate the vulnerability and should be treated as a partial mitigation only.