PT-2026-42747 · Mattermost · Mattermost

Daw10 · CVE-2026-4635 · Published 2026-05-22 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description An issue exists where the system fails to archive the channel before removing persistent notifications. This allows an authenticated user to cause a server crash by timing the creation of a persistent notification message to occur between the server deleting existing persistent notifications and the archiving of the channel, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2026-07532

CVE-2026-4635

GHSA-PG7C-462J-GRXV

GO-2026-5820

Affected Products

Mattermost

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4635.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-4635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4635 · Security Note
• https://osv.dev/vulnerability/GHSA-pg7c-462j-grxv · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07532 · Security Note
• https://osv.dev/vulnerability/GO-2026-5820 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/advisories/GHSA-pg7c-462j-grxv · Note
• https://t.me/CVEtracker/54626 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4635 · Note
• https://vuldb.com/vuln/365182 · Note