{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Mattermost, Inc. heeft kwetsbaarheden verholpen in Mattermost versies 10.11.x, 11.7.x en 11.8.x, inclusief de GitLab plugin tot versie 11.8.", "title": "Feiten" }, { "category": "description", "text": "De kwetsbaarheden betreffen meerdere aspecten van de Mattermost software, waaronder onjuiste validatie van WebSocket command velden, onjuiste reconciliatie van SchemeAdmin flags, en onvoldoende verificatie van kanaaleigendom bij ABAC policy unassign endpoints. Hierdoor kunnen geauthenticeerde gebruikers onder andere denial-of-service veroorzaken door het laten crashen van plugin processen, administratieve privileges behouden na demotie, en ongeautoriseerde wijzigingen aanbrengen in toegangscontrolebeleid en board-rollen. Verder kunnen guest gebruikers via speciaal vervaardigde boardarchiefbestanden hun privileges escaleren naar Board Admin. OAuth applicaties kunnen tokens en autorisaties van andere integraties intrekken door onvoldoende restricties op deaccountbeheer endpoints. Ook is het mogelijk om voltooide playbook runs te wijzigen door het ontbreken van run-state validatie. Daarnaast kunnen gebruikers zonder voldoende leesrechten boards koppelen aan kanalen, waardoor lidmaatschappen van private kanalen worden blootgesteld. Channel administrators kunnen hun permissies verhogen via manipulatie van de channel member roles API.\n\nDe GitLab plugin vertoont een kwetsbaarheid waardoor bots berichten met willekeurige URLs kunnen injecteren in kanalen zonder toegangsrechten. Thread membership records worden niet verwijderd bij vertrek uit een team, wat toegang tot private thread content kan geven bij herintreding. Ten slotte is er een kwetsbaarheid in de server-side validatie van BoardMember.Scheme* velden, waardoor privilege escalatie mogelijk is door het toekennen van board admin rechten aan willekeurige gebruikers, en een permissiecontrole ontbreekt bij het relinken van boards aan kanalen via de batch endpoint.", "title": "Interpretaties" }, { "category": "description", "text": "Mattermost, Inc. heeft updates uitgebracht om de kwetsbaarheden te verhelpen in de genoemde versies van Mattermost en de GitLab plugin. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Input Validation", "title": "CWE-20" }, { "category": "general", "text": "Exposure of Sensitive Information to an Unauthorized Actor", "title": "CWE-200" }, { "category": "general", "text": "Improper Privilege Management", "title": "CWE-269" }, { "category": "general", "text": "Permission Issues", "title": "CWE-275" }, { "category": "general", "text": "Improper Authorization", "title": "CWE-285" }, { "category": "general", "text": "State Issues", "title": "CWE-371" }, { "category": "general", "text": "Incomplete Cleanup", "title": "CWE-459" }, { "category": "general", "text": "Incorrect Type Conversion or Cast", "title": "CWE-704" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "general", "text": "Incorrect Authorization", "title": "CWE-863" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://mattermost.com/security-updates/" } ], "title": "Kwetsbaarheden verholpen in Mattermost", "tracking": { "current_release_date": "2026-08-19T06:34:05.276310Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0305", "initial_release_date": "2026-08-19T06:34:05.276310Z", "revision_history": [ { "date": "2026-08-19T06:34:05.276310Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "Mattermost" } ], "category": "vendor", "name": "Mattermost" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-10080", "cwe": { "id": "CWE-704", "name": "Incorrect Type Conversion or Cast" }, "notes": [ { "category": "other", "text": "Incorrect Type Conversion or Cast", "title": "CWE-704" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 contain a vulnerability where improper validation of WebSocket command field types allows an authenticated user to crash the plugin process and cause denial of service via a crafted custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-10080 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-10080.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-10080" }, { "cve": "CVE-2026-10527", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x to 11.7.6, 10.11.x to 10.11.21, and 11.8.x to 11.8.3 contain a vulnerability where SchemeAdmin flags are not properly updated upon user role demotion, allowing System Guests to retain Board Admin privileges and perform restricted actions.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-10527 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-10527.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-10527" }, { "cve": "CVE-2026-15754", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6 and 11.8.x through 11.8.3 contain an access control vulnerability allowing authenticated team admins to improperly remove ABAC policy assignments from channels outside their team after channel relocation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-15754 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-15754.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N", "baseScore": 4.2, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-15754" }, { "cve": "CVE-2026-16044", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 contain a vulnerability allowing guest users to escalate privileges to Board Admin by importing a malicious .boardarchive file.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16044 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16044.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16044" }, { "cve": "CVE-2026-16045", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 contain a security vulnerability allowing OAuth apps with delegated user tokens to revoke authorizations or tokens of other integrations via insufficiently restricted account-management endpoints.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16045 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16045.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16045" }, { "cve": "CVE-2026-16046", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 contain a vulnerability allowing modification of completed playbook runs via API due to missing run-state validation enforcement.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16046 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16046.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16046" }, { "cve": "CVE-2026-16047", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 contain a vulnerability allowing authenticated users to discover private channel memberships by linking boards to channels without proper read access validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16047 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16047.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16047" }, { "cve": "CVE-2026-16048", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.8.x through 11.8.2, 11.7.x through 11.7.6, and 10.11.x through 10.11.21 contain a vulnerability allowing channel administrators to escalate permissions by assigning channel member roles via the channel member roles API.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16048 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16048.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16048" }, { "cve": "CVE-2026-16049", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Mattermost GitLab plugin versions up to 11.8, including 10.20.11 and 11.5.7.0, contain a vulnerability allowing authenticated attackers to inject bot-authored messages with arbitrary URLs into unauthorized channels due to improper channel permission and URL validation.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-16049 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16049.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-16049" }, { "cve": "CVE-2026-9693", "cwe": { "id": "CWE-459", "name": "Incomplete Cleanup" }, "notes": [ { "category": "other", "text": "Incomplete Cleanup", "title": "CWE-459" }, { "category": "description", "text": "Mattermost versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5 contain a vulnerability where thread membership records persist after user removal, enabling re-invited users to access private thread content and metadata via the team threads API.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-9693 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9693.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "baseScore": 3.5, "baseSeverity": "LOW" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-9693" }, { "cve": "CVE-2026-9816", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 contain a vulnerability allowing board editors or non-guest team members to escalate privileges and assign board admin rights via improper server-side validation of BoardMember.Scheme* fields during API calls.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-9816 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9816.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 8.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-9816" }, { "cve": "CVE-2026-9859", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "other", "text": "Incorrect Authorization", "title": "CWE-863" }, { "category": "description", "text": "Mattermost versions 11.7.x to 11.7.6, 10.11.x to 10.11.21, and 11.8.x to 11.8.3 contain a vulnerability where the PermissionManageBoardRoles is not enforced on the channelId field of the batch endpoint, enabling authenticated board editors to relink boards to arbitrary channels via crafted PATCH requests.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1" ] }, "references": [ { "category": "self", "summary": "CVE-2026-9859 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9859.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1" ] } ], "title": "CVE-2026-9859" } ] }