CVE-2026-10080
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.7.0 <= 11.7.6 | affected |
| Mattermost | Mattermost | 10.11.0 <= 10.11.21 | affected |
| Mattermost | Mattermost | 11.8.0 <= 11.8.3 | affected |
| Mattermost | Mattermost | 11.9.0 | unaffected |
| Mattermost | Mattermost | 11.7.7 | unaffected |
| Mattermost | Mattermost | 10.11.22 | unaffected |
| Mattermost | Mattermost | 11.8.4 | unaffected |
Weaknesses
- CWE-704: CWE-704: Incorrect Type Conversion or Cast
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.