PT-2026-43013 · Mattermost · Mattermost

Daw10 · Published 2026-05-25 · Updated 2026-07-07 · CVE-2026-4915

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14

Description An issue exists where the system fails to filter nil elements from outgoing webhook attachment payloads before processing. This allows an authenticated user to cause a denial of service, resulting in server process termination, by sending a crafted webhook callback response that contains a null attachment entry.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2026-07549

CVE-2026-4915

GHSA-5GMF-X7HG-97WF

GO-2026-5845

Affected Products

Mattermost

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4915.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4915 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07549 · Security Note
• https://osv.dev/vulnerability/GHSA-5gmf-x7hg-97wf · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5845 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4915 · Vendor Advisory
• https://github.com/mattermost/mattermost/commit/faa7d75b4ea041701e97948f8aa1332e3626a39a · Note
• https://github.com/mattermost/mattermost · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4915 · Note
• https://github.com/advisories/GHSA-5gmf-x7hg-97wf · Note
• https://t.me/CVEtracker/54834 · Telegram Post