CVE-2026-86348

Published: Sep 14, 2026Modified: Sep 16, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.8 / Impact: 1.4

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701

Related CWEs

CWE-704

Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Timeline

No history available yet.