Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Mattermost GitLab Plugin: Unrestricted Channel Access

CVE-2026-16049 · published 2 months ago
Summary

An attacker can post messages in channels they shouldn't have access to. This is possible because the Mattermost GitLab plugin doesn't properly check permissions when processing API requests. To fix this, update the Mattermost GitLab plugin to version 11.9 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mattermost mattermost <= 10.20.11
Original advisory text
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails t...
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published17 Aug 2026
Updated3 Nov 2026
First seen17 Aug 2026
Sources
CVE-2026-16049 · NVD
CVE-2026-16049 · MITRE
Track software like this
Free during beta