CVE-2026-27656

Published: Mar 25, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Exploitability: 0.9 / Impact: 5.2

Source: NVD

Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590

Affected (4)

Products: Mattermost: Mattermost Server

Mattermost

1 product

Mattermost Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	From 10.11.0 to 10.11.12
Mattermost Mattermost Server	From 11.2.0 to 11.2.4
Mattermost Mattermost Server	From 11.3.0 to 11.3.2
Mattermost Mattermost Server	From 11.4.0 to 11.4.1

Related CWEs

CWE-303

Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.