Mattermost EUVD-2026-109939

Requires an actor with Mattermost System Administrator privileges (PR:H) on an instance running an affected version (11.7.x <= 11.7.10) that uses OpenID Connect, since the admin must set the OpenID discovery endpoint URL; the flaw is that outbound internal-connection filtering is not applied to that discovery fetch, which is then triggered by an unauthenticated login request. The dominant limiting factor is the System Administrator prerequisite - an actor with that role already controls the server configuration - which sharply reduces real-world risk despite the network attack vector; impact is confined to inferring reachability of internal addresses/ports (C:L), with no integrity or availability effect.

This is a low-priority, high-CVSS-does-not-apply case - the assigned CVSS 3.1 base score is only 2.7 (LOW), consistent with the limited impact. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N shows the critical gating factor: PR:H means the actor must already hold System Administrator privileges, which the description confirms ('allows a System Administrator to determine...'). The only impact is C:L (I:N/A:N): the attacker learns whether internal addresses and ports are reachable from the server - a blind SSRF / internal reachability probe (CWE-918), not data theft or code execution. No EPSS score was provided, there is no CISA KEV listing, and no PoC or exploit reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'monitor', aligning with all signals pointing to low urgency. The key tension worth stating: because exploitation requires an existing System Administrator - an actor who can already reconfigure the server, read secrets, and pivot by design - the marginal value of this SSRF to a real attacker is small, which is why both the CVSS score and the decision label are low.

A user who already holds Mattermost System Administrator rights configures the OpenID Connect integration with a discovery endpoint URL pointing at an internal host and port, then issues an unauthenticated login request that triggers the server-side discovery fetch. By observing the server's response or timing, they infer whether that internal address and port are reachable from the Mattermost host, effectively using the server as an internal port/reachability scanner. No public exploit code is identified at time of analysis.