CVE-2026-2462
6.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Summary
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | 11.3.0 <= 11.3.0 | affected |
| Mattermost | Mattermost | 11.2.0 <= 11.2.2 | affected |
| Mattermost | Mattermost | 10.11.0 <= 10.11.10 | affected |
| Mattermost | Mattermost | 11.4.0 | unaffected |
| Mattermost | Mattermost | 11.3.1 | unaffected |
| Mattermost | Mattermost | 11.2.3 | unaffected |
| Mattermost | Mattermost | 10.11.11 | unaffected |
Weaknesses
- CWE-863: CWE-863: Incorrect Authorization
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.