What is the CVSS score of EUVD-2026-30746?

EUVD-2026-30746 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Mattermost Plugins EUVD-2026-30746

Q: Which versions of Mattermost Plugins are affected by EUVD-2026-30746?

Mattermost Plugins through version 11.5 allow authenticated users to bypass group-level access controls and create issues or attach comments to locked groups they should not access.

| CVE-2026-6341 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-668g-wr24-468v

Mattermost Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:17 vuln.today

DescriptionCVE.org

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID: MMSA-2026-00602

AnalysisAI

Mattermost Plugins through version 11.5 allow authenticated users to bypass group-level access controls and create issues or attach comments to locked groups they should not access. Attackers holding membership in multiple groups can exploit missing API-level authorization checks via direct API requests to write data into restricted groups, violating intended access boundaries. EPSS risk data not available; CVSS 4.3 reflects low-privilege authenticated network attack with low complexity. No active exploitation confirmed by CISA KEV at time of analysis, though vendor advisory (MMSA-2026-00602) confirms the vulnerability.

Technical ContextAI

This vulnerability affects the Mattermost Plugins component across versions 11.5, 11.1.5, 10.13.11, and 11.3.4.0. The root cause is CWE-863 (Incorrect Authorization), where the API layer fails to enforce group-based access control decisions. While the UI may properly restrict access to locked groups, the underlying API endpoints do not validate whether the authenticated user should have write permissions to specific groups. This creates a confused deputy scenario where multi-group membership enables privilege escalation-users can reference group identifiers in API calls to bypass intended restrictions. The CPE identifier cpe:2.3:a:mattermost:mattermost confirms the Mattermost server/plugins ecosystem as the affected product.

RemediationAI

Upgrade Mattermost to the patched version specified in vendor advisory MMSA-2026-00602 available at https://mattermost.com/security-updates. Exact fix version numbers are not provided in available CVE data, so consult the advisory directly for upgrade targets corresponding to each affected branch (11.x, 10.x series). If immediate patching is not feasible, implement compensating controls: (1) Audit API access logs for unexpected cross-group issue creation or comment activity by reviewing user group memberships against issue creation timestamps; (2) Restrict API access to trusted networks via firewall rules or reverse proxy ACLs, though this does not prevent exploitation by authenticated internal users; (3) Review and minimize multi-group memberships to reduce the attack surface, understanding this may disrupt legitimate workflows requiring cross-team collaboration. Note that disabling plugins entirely may impact core Mattermost functionality depending on deployment configuration. No workaround fully mitigates the vulnerability-patching remains the primary remediation path.