CVE-2026-27659

🗓️ 25 Mar 2026 16:33:32Reported by MattermostType

cve🔗 web.nvd.nist.gov👁 26 Views🌐 WEB

CSRF flaw in activate policy endpoint enables tricking admin into changing policy status.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-27659	25 Mar 202616:33	–	attackerkb
Circl	CVE-2026-27659	25 Mar 202618:08	–	circl
CNNVD	Mattermost 安全漏洞	25 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint	25 Mar 202616:33	–	cvelist
EUVD	EUVD-2026-15806	25 Mar 202618:31	–	euvd
Github Security Blog	Mattermost doesn't properly validate CSRF tokens	25 Mar 202618:31	–	github
NVD	CVE-2026-27659	25 Mar 202617:16	–	nvd
OSV	CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint	25 Mar 202616:33	–	osv
OSV	GHSA-RMHW-C3XR-M3XX Mattermost doesn't properly validate CSRF tokens	25 Mar 202618:31	–	osv
OSV	GO-2026-5629 Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server	25 Jun 202622:34	–	osv

NVD

Node

mattermost mattermost_serverRange10.11.0–10.11.11

mattermost mattermost_serverRange11.2.0–11.2.3

mattermost mattermost_serverRange11.3.0–11.3.2

mattermost mattermost_serverRange11.4.0–11.4.1

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "11.2.2",
        "status": "affected",
        "version": "11.2.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "10.11.10",
        "status": "affected",
        "version": "10.11.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "11.4.0",
        "status": "affected",
        "version": "11.4.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "11.3.1",
        "status": "affected",
        "version": "11.3.0",
        "versionType": "semver"
      },
      {
        "version": "11.5.0",
        "status": "unaffected"
      },
      {
        "version": "11.2.3",
        "status": "unaffected"
      },
      {
        "version": "10.11.11",
        "status": "unaffected"
      },
      {
        "version": "11.4.1",
        "status": "unaffected"
      },
      {
        "version": "11.3.2",
        "status": "unaffected"
      }
    ]
  }
]

Source	Link
mattermost	www.mattermost.com/security-updates

Parameter	Position	Path	Description	CWE
policy_id	path	/api/v4/access_control_policies/{policy_id}/activate	CSRF token validation flaw allowing an attacker to trick an admin into changing the active status of an access control policy via a crafted request.	CWE-352

17 Jun 2026 10:27Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.6

EPSS0.00123

SSVC

CWE-352