CVE-2026-96259

Published: Sep 22, 2026Modified: Oct 7, 2026

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: responsibledisclosure@mattermost.com (Secondary)

Description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776

Affected (4)

Products: Mattermost: Mattermost Server

Mattermost

1 product

Mattermost Server

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mattermost Mattermost Server	11.10.0 ≤ version < 11.10.2
Mattermost Mattermost Server	11.7.0 ≤ version < 11.7.11
Mattermost Mattermost Server	11.8.0 ≤ version < 11.8.6
Mattermost Mattermost Server	11.9.0 ≤ version < 11.9.2

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://mattermost.com/security-updates

Source: responsibledisclosure@mattermost.com

Vendor Advisory

Timeline

No history available yet.