EUVD-2026-30749
GHSA-xvcx-mgpc-5xh3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636
AnalysisAI
Authenticated Mattermost channel members can forcibly reveal burn-on-read messages without recipient consent by exploiting missing X-Requested-With header validation on the reveal endpoint through crafted Markdown image tags. This bypasses the intended ephemeral messaging security control in Mattermost versions 11.4.x through 11.4.3 and 11.5.x through 11.5.1. The CVSS vector indicates network-accessible exploitation by low-privileged authenticated users with low attack complexity. Exploitation status: no public exploit identified at time of analysis. EPSS data not provided.
Technical ContextAI
Burn-on-read is a Mattermost feature providing ephemeral messaging where messages are automatically deleted after being viewed by recipients. The vulnerability stems from inadequate Origin header validation (CWE-346: Origin Validation Error) on the burn-on-read reveal API endpoint. The endpoint fails to validate the X-Requested-With header, a common CSRF defense mechanism. Attackers exploit this by embedding malicious Markdown image tags in channel messages. When the Markdown renderer processes the image tag, it triggers an HTTP request to the reveal endpoint without proper origin checks, causing the burn-on-read message to be revealed server-side. The affected CPE (cpe:2.3:a:mattermost:mattermost) confirms this impacts the core Mattermost server application across specified version ranges, not plugins or mobile clients.
RemediationAI
Upgrade to Mattermost server versions newer than 11.5.1 or 11.4.3 as the vendor has released fixes per advisory MMSA-2026-00636. Specific patched versions not published in available data - consult https://mattermost.com/security-updates for exact fixed release numbers. As interim mitigation if immediate patching is infeasible, consider disabling burn-on-read messaging feature entirely until upgrade completes, though this eliminates the feature's business value. Implement strict channel membership controls to limit authenticated user access to sensitive burn-on-read channels, reducing insider threat surface. Configure web application firewalls to enforce X-Requested-With header presence on API endpoints if architectural compatibility permits, though this may break legitimate integrations. Monitor server logs for unusual access patterns to burn-on-read reveal endpoints, particularly high-frequency requests from single authenticated sessions. Note that compensating controls cannot fully prevent exploitation by legitimate authenticated channel members.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today