EUVD-2026-31465
GHSA-r5vf-grcx-5vqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628
AnalysisAI
OAuth scope validation bypass in Mattermost's GitHub integration allows authenticated users to escalate repository access beyond what was originally authorized. By manipulating the scope parameter in the GitHub OAuth authorization URL before the callback is processed, a low-privileged Mattermost user can obtain a GitHub token with broader permissions - including access to private repositories - than the application intended to grant. Affecting versions across four active release branches (10.11.x through 11.6.x), this is no public exploit identified at time of analysis and is not listed in CISA KEV, but the low complexity and authentication-only barrier make it a realistic insider or compromised-account risk.
Technical ContextAI
Mattermost integrates with GitHub via OAuth 2.0, allowing users to link their GitHub accounts for repository browsing or plugin functionality. During the OAuth authorization flow, a client initiates a request to GitHub with a defined scope parameter that specifies what permissions are being requested (e.g., read:user, public_repo). After the user authorizes the app on GitHub's side, GitHub redirects back to Mattermost's callback endpoint with an authorization code. CWE-863 (Incorrect Authorization) identifies the root cause: Mattermost's callback handler fails to verify that the scope embedded in the returned token matches the scope originally requested. This means an attacker can modify the scope in the outbound authorization URL to request elevated permissions (e.g., repo, which grants access to private repositories), and Mattermost will silently accept and store the resulting over-privileged token. The affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* across branches 10.11.x, 11.4.x, 11.5.x, and 11.6.x.
RemediationAI
Upgrade to a patched release per Mattermost's security advisory MMSA-2026-00628, available at https://mattermost.com/security-updates. The exact fixed version numbers are not independently confirmed in the available reference data beyond the vendor advisory page - administrators should consult that page for the specific target versions in their branch (10.11.x, 11.4.x, 11.5.x, or 11.6.x). As a compensating control for organizations that cannot immediately patch, disabling the GitHub OAuth integration in Mattermost's system console (System Console > Integrations > OAuth 2.0) will eliminate the attack surface entirely, though this removes GitHub-linked functionality for all users. Restricting which users can initiate OAuth flows via role-based access controls may limit exposure but does not eliminate the underlying flaw. Auditing existing GitHub OAuth tokens granted through Mattermost for unexpected scope elevation is advisable regardless of patch status.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today