EUVD-2026-60210

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...

CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...

CVE-2026-16045

Mattermost 11.7.x (≤11.7.6) and 10.11.x (≤10.11.21) failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions. A malicious OAuth app holding a delegated user token could revoke the user's authorizations or tokens for unrelated integrations via...

CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...

CVE-2026-16045

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...

EUVD-2026-60209

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16049

The Mattermost GitLab plugin (versions ≤11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions for caller-supplied post_id and does not validate the web_url parameter against the configured GitLab instance. Through the createIssue and attachCommentToIssue API endpoints, an authenticated at...

CVE-2026-16049

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...

CVE-2026-16047 Board channel linking without read channel permission validation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

EUVD-2026-60208

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

CVE-2026-16047

Mattermost versions 11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, and 11.8.x ≤ 11.8.3 contain an authorization flaw in the board-to-channel linking functionality. The server fails to verify that the requesting user has read access to a target channel before associating a board with it. An authenticated us...

CVE-2026-16046 Missing run-state validation on finished playbook runs

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046

Mattermost versions 11.7.x ≤ 11.7.6 and 10.11.x ≤ 10.11.21 lack run-state validation on write operations for completed playbook runs, enabling authenticated participants to alter status, checklists, retrospective content, ownership, and participants via REST and GraphQL APIs. No patch version or ...

EUVD-2026-60207

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16048

Mattermost versions 11.8.x through 11.8.2, 11.7.x through 11.7.6, and 10.11.x through 10.11.21 fail to restrict the channel member roles API to channel-scoped roles, allowing a channel administrator to assign out-of-scope roles and gain additional permissions. Advisory MMSA-2026-00697 tracks the ...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

EUVD-2026-60206

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...