PT-2026-41641 · Mattermost · Mattermost

Shoodagiri · Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-3495

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description Failure to escape certain variables during the composition of error pages allows an attacker with permissions to edit site configurations to execute malicious code by injecting JavaScript into those values.

Recommendations Update versions 11.5.0 through 11.5.1 to a version later than 11.5.1. Update versions 10.11.0 through 10.11.13 to a version later than 10.11.13.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3495

GHSA-JX93-PF6X-874R

Affected Products

Mattermost

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3495 · Security Note
• https://osv.dev/vulnerability/GHSA-jx93-pf6x-874r · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/5a1ea95044dc2d1ca601bfe9a4c1bc17990f3872 · Note
• https://github.com/mattermost/mattermost · Note
• https://t.me/CVEtracker/54102 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3495 · Note