← Back

CVE-2026-13417

nvd nist
Published: Sep 14, 2026Modified: Oct 7, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Exploitability: 2.8 / Impact: 1.4
Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type of `fields.properties` on block creation which allows an authenticated user with editor access to a board to crash the Boards plugin worker and trigger a denial of service via a child block whose `fields.properties` is a non-object value. Mattermost Advisory ID: MMSA-2026-00710

Affected (4)

Mattermost
1 product
Mattermost Server
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Mattermost
Mattermost Server
10.11.0 ≤ version < 10.11.23
Mattermost Server
11.7.0 ≤ version < 11.7.8
Mattermost Server
11.8.0 ≤ version < 11.8.5
Mattermost Server
11.9.0 ≤ version < 11.9.1

Related CWEs

CWE-754
Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (1)

Source: responsibledisclosure@mattermost.com
Vendor Advisory

Timeline

No history available yet.