EUVD-2026-15805
GHSA-fg35-5rf6-qg3g
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590
AnalysisAI
Mattermost fails to properly validate user identity in OpenID Connect authentication logic due to an overly permissive substring matching flaw in the IsSameUser() comparison function, allowing attackers with high privileges to take over arbitrary user accounts through the user discovery flow. This affects Mattermost versions 10.11.0-10.11.11, 11.2.0-11.2.3, 11.3.0-11.3.1, and 11.4.0. While the CVSS score of 5.7 is moderate and requires high privilege access and user interaction, the core impact is account takeover with full account compromise possible.
Technical ContextAI
The vulnerability resides in Mattermost's OpenID Connect (OIDC) authentication handler, specifically within the identity validation logic that compares user identities during SSO flows. The affected component uses a substring matching comparison rather than strict equality checking in the IsSameUser() function, which violates CWE-303 (Incorrect Implementation of Authentication Algorithm). The CPE string cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* indicates the core Mattermost application is vulnerable across multiple major and minor versions. The vulnerability exists in the user discovery mechanism that processes OpenID claims, allowing attackers to craft requests that partially match legitimate user identifiers and bypass identity verification controls.
RemediationAI
Immediately upgrade Mattermost to patched versions: 10.11.12 or later for the 10.11.x line, 11.2.4 or later for the 11.2.x line, 11.3.2 or later for the 11.3.x line, and 11.4.1 or later for the 11.4.x line. The primary fix involves correcting the IsSameUser() comparison logic to use strict equality matching rather than substring matching. Until patches can be deployed, restrict OpenID Connect authentication to trusted identity providers and limit administrative access to SSO configuration. Review OIDC claims and user discovery API logs for anomalous patterns indicating exploitation attempts. Consider temporarily disabling OpenID authentication in non-production environments until patching is complete. Consult the Mattermost security advisory at https://mattermost.com/security-updates for detailed guidance.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today