PT-2026-48940 · Mattermost · Mattermost

Winfunc · CVE-2026-7184 · Published 2026-06-12 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.6.x through 11.6.1 Mattermost versions 11.5.x through 11.5.4 Mattermost versions 10.11.x through 10.11.15

Description Insufficient sanitization of the Remote Cluster API response during PATCH operations allows authenticated users possessing the manage secure connections permission to obtain remote cluster authentication tokens. This occurs when a PATCH request is sent to the remote cluster endpoint.

Recommendations Update versions 11.6.x through 11.6.1 to a newer version. Update versions 11.5.x through 11.5.4 to a newer version. Update versions 10.11.x through 10.11.15 to a newer version.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-7184

Affected Products

Mattermost

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7184.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-7184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7184 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://t.me/CVEtracker/56729 · Telegram Post