CVE-2026-16049

The Mattermost GitLab plugin (versions ≤11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions for caller-supplied post_id and does not validate the web_url parameter against the configured GitLab instance. Through the createIssue and attachCommentToIssue API endpoints, an authenticated at...