Mattermost Plugins CVE-2026-6342

Requires authenticated access to Mattermost as a low-privilege plugin user (PR:L from CVSS vector). The Mattermost instance must have plugin subscription functionality enabled and actively configured with group-based whitelisting for notification or data access. Exploitation depends on administrators having defined whitelisted group namespaces that the plugin system uses for authorization decisions. The vulnerability is exploitable in default configurations where plugin users can create new groups, but has no impact in deployments where plugins are disabled, group-based subscriptions are not used, or group creation is restricted to administrators only. Does not require elevated privileges, user interaction, or non-standard network configurations, making it accessible to any authenticated user in vulnerable configurations.

Real-world risk is moderate despite the relatively low CVSS 4.3 score. The CVSS vector indicates straightforward exploitation (AC:L) by any authenticated plugin user (PR:L) over the network (AV:N), with no user interaction required (UI:N). However, impact is constrained to integrity violations (I:L) - unauthorized group subscriptions - rather than confidentiality breaches or service disruption. EPSS probability data is not available for this 2026 CVE, limiting predictive risk assessment. Absence from CISA KEV and lack of public exploit code suggest this is not yet widely exploited in the wild. Primary risk exists in multi-tenant Mattermost deployments or environments with strict channel segmentation policies where unauthorized cross-group visibility could leak sensitive project information through notification systems. Organizations not using the plugin subscription feature or those with flat permission models face minimal practical risk despite network exploitability. The authenticated prerequisite and lack of confidentiality impact reduce urgency compared to unauthenticated RCE vulnerabilities, but organizations leveraging Mattermost's group-based access controls for compliance or data segregation should prioritize remediation.

An authenticated Mattermost plugin user with low privileges identifies that the 'finance-team' group is whitelisted for expense notification subscriptions. The attacker creates a new plugin group named 'finance-team-shadow' which passes the flawed prefix-matching validation. By subscribing this unauthorized group to expense approval channels, the attacker receives notifications containing sensitive financial data intended only for legitimate finance team members, bypassing the organization's channel access controls without triggering audit alerts.