What is the CVSS score of EUVD-2026-38249?

EUVD-2026-38249 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-38249

Q: Which versions of Mattermost are affected by EUVD-2026-38249?

Missing authentication on the Atlassian Connect install callback in Mattermost allows a remote attacker to inject a rogue sharedSecret into an in-progress Jira integration setup.

| CVE-2026-6673 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-22 Mattermost

GHSA-jqgv-39mg-7c2r

Authentication Bypass Atlassian Mattermost

6.4

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

vuln.today AI

6.8 MEDIUM

AV:N and AC:H reflect network-reachable but timing-dependent exploitation; PR:N chosen because description explicitly states unauthenticated attacker, overriding vendor PR:L pending clarification; UI:R retained as admin must initiate install.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 14:41 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret and disrupt the Jira integration via POST to /ac/installed during the pending-install window.. Mattermost Advisory ID: MMSA-2026-00654

AnalysisAI

Missing authentication on the Atlassian Connect install callback in Mattermost allows a remote attacker to inject a rogue sharedSecret into an in-progress Jira integration setup. Affected versions span the 10.11.x, 11.5.x, 11.6.x, and 11.7.x release trains, all of which expose the POST /ac/installed endpoint without validating the caller's identity during the pending-install window. No public exploit has been identified at time of analysis, but a successful injection corrupts the integration's trust handshake, yielding high integrity and availability impact against the Jira connection. The vendor CVSS vector assigns PR:L, which conflicts with the description's 'remote unauthenticated attacker' language - this discrepancy warrants direct verification with Mattermost advisory MMSA-2026-00654.

Technical ContextAI

Atlassian Connect is the framework that Jira and other Atlassian products use to register third-party integrations. During installation, the Atlassian product performs a lifecycle callback - a POST to a registered /ac/installed URL on the host application - carrying a sharedSecret that is subsequently used to sign and verify all inter-service JWT tokens. CWE-306 (Missing Authentication for Critical Function) precisely describes the flaw: Mattermost accepts this callback and stores the transmitted sharedSecret without verifying that the request genuinely originated from Atlassian, nor that the receiving instance had actually initiated an install. Affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*, covering the four release trains listed. An attacker who can POST to this endpoint with a controlled sharedSecret effectively becomes the trusted Jira peer in Mattermost's eyes for that integration, invalidating the legitimate integration's authentication material.

RemediationAI

The primary remediation is to upgrade to a patched Mattermost release as published in the vendor advisory at https://mattermost.com/security-updates (MMSA-2026-00654). Exact fixed versions are not independently confirmed in the available data beyond the vulnerable ranges - operators should consult the advisory directly to identify the minimum safe version for their release train (10.11.x, 11.5.x, 11.6.x, or 11.7.x). Patch available per vendor advisory. As a compensating control while patching is scheduled, consider restricting network-level access to the /ac/installed endpoint via a reverse proxy or WAF rule so only known Atlassian IP ranges (published by Atlassian) can reach it - this reduces the attack surface without disabling the integration entirely, though it introduces operational overhead if Atlassian changes its egress addresses. Disabling the Jira integration plugin entirely eliminates the attack surface but also removes Jira functionality. Avoid initiating new Jira app installations on unpatched instances until the fix is applied, as this opens the vulnerable pending-install window.