PT-2026-33037 · Mattermost · Mattermost

Eva Sarafianou · Published 2026-04-15 · Updated 2026-04-17 · CVE-2026-28741

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.12 Mattermost version 11.5.0 Mattermost versions 11.4.0 through 11.4.2 Mattermost versions 11.3.0 through 11.3.2

Description An authentication endpoint fails to validate CSRF tokens. This allows an attacker to update a user authentication method by tricking a user into visiting a malicious page via a Cross-Site Request Forgery (CSRF) attack, which is a technique where an unauthorized command is transmitted to a web application from a user that the application trusts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-28741

GHSA-M7CF-4GH2-V4QG

Affected Products

Mattermost

References · 8

• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m7cf-4gh2-v4qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28741 · Security Note
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/infoflowcloud/status/2044739548240908800 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28741 · Note
• https://twitter.com/CVEnew/status/2044738004753805588 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044507888261984599 · Twitter Post