What is the CVSS score of CVE-2026-6342?

CVE-2026-6342 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Mattermost Plugins CVE-2026-6342

Q: Which versions of Mattermost Plugins are affected by CVE-2026-6342?

Authorization bypass in Mattermost Plugins allows authenticated users to subscribe to unauthorized notification groups by exploiting prefix-matching namespace validation.

EUVD-2026-30745 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-x3f7-3cx7-2cw7

Mattermost Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:17 vuln.today

DescriptionCVE.org

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to appropriately check for valid namespaces which allows plugin users to create subscriptions to groups that were not whitelisted via creating groups that share the same prefix as a whitelisted group. Mattermost Advisory ID: MMSA-2026-00601

AnalysisAI

Authorization bypass in Mattermost Plugins allows authenticated users to subscribe to unauthorized notification groups by exploiting prefix-matching namespace validation. Affected versions (≤11.5, 11.1.5, 10.13.11, 11.3.4.0) fail to enforce group whitelisting, enabling low-privileged plugin users to create groups sharing prefixes with authorized groups and thereby receive notifications or access information from out-of-scope channels. EPSS data unavailable; not listed in CISA KEV; CVSS 4.3 reflects low-privilege network exploitation with limited integrity impact but no confidentiality or availability compromise.

Technical ContextAI

Mattermost Plugins is the extensibility framework for Mattermost collaboration platform (CPE 2.3:a:mattermost:mattermost). This vulnerability stems from CWE-863 (Incorrect Authorization), where the plugin system's namespace validation logic uses prefix-based matching instead of exact group identifier comparison. When administrators whitelist specific groups for plugin subscriptions (e.g., 'engineering-team'), the flawed validation allows creation of similarly-prefixed groups (e.g., 'engineering-team-malicious') that bypass access controls. The CVSS vector AV:N/AC:L/PR:L indicates network-accessible exploitation by authenticated low-privilege users without additional complexity, though the scope remains unchanged (S:U) and impact is limited to integrity modification (I:L) of subscription data rather than direct data exfiltration.

RemediationAI

Upgrade to the patched Mattermost version specified in Mattermost Security Advisory MMSA-2026-00601 available at https://mattermost.com/security-updates. The advisory references fix versions for affected release branches (exact patch versions not provided in input data but should be confirmed from vendor source). If immediate patching is not feasible, implement compensating controls: disable plugin subscription features system-wide via Mattermost configuration settings (config.json PluginSettings.Enable = false) until upgrade completes, though this breaks legitimate plugin functionality; alternatively, audit existing plugin-created groups against whitelisted namespaces and remove unauthorized groups matching whitelisted prefixes, then restrict plugin installation permissions to administrators only via System Console > Plugins > Management settings to prevent low-privilege users from exploiting the namespace validation flaw. Note that disabling all plugins impacts collaboration workflows dependent on integrations like Jira, GitHub, or Zoom plugins.