PT-2026-42748 · Mattermost · Mattermost+1

Mariusz Maik · Published 2026-05-22 · Updated 2026-07-07 · CVE-2026-4646

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description Insufficient input validation in the GitHub plugin API request handlers allows an authenticated attacker to cause a denial of service by crashing the plugin process. This is achieved by sending a crafted HTTP request to the 'PR details' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1287

Related Identifiers

BDU:2026-07546

CVE-2026-4646

GHSA-RMVV-8V8W-RF7X

GO-2026-5833

Affected Products

Github Plugin

Mattermost

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4646.json · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4646 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4646 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5833 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07546 · Security Note
• https://osv.dev/vulnerability/GHSA-rmvv-8v8w-rf7x · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost-plugin-github/commit/c2840e980b3c2bd08db656eaa6a0fe26bcbf4695 · Note
• https://t.me/CVEtracker/54624 · Telegram Post
• https://github.com/advisories/GHSA-rmvv-8v8w-rf7x · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4646 · Note