Mattermost Server patched for multiple unspecified security vulnerabilities

1. Executive summary

CERT-FR published an advisory on 20 October 2026 covering multiple vulnerabilities in Mattermost Server, fixed in 11.7.12, 11.8.6, 11.10.3 and 11.11.2. The advisory names fifteen Mattermost security bulletins (MMSA-2026-00720 through MMSA-2026-00785) issued on 19 October 2026 but gives no CVE identifiers, no CVSS scores and no vulnerability classes; CERT-FR records the risk as "non spécifié par l'éditeur". No CVE has been assigned in the material available to Adverse Trace, no entry appears in CISA KEV, and no EPSS score can be cited. The bottom-line risk to EMEA financial services is unquantified rather than low: a self-hosted collaboration server that holds message history, file attachments and channel membership is a plausible target, and the patch gap is real, but the severity of what is being fixed cannot be stated from the source. Treat this as a patch-now item on operational grounds, not on a scored threat assessment.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The source does not describe an attack chain. CERT-FR states only that multiple vulnerabilities were discovered in Mattermost Server and that they allow an attacker to cause a security problem unspecified by the editor. There is no initial access vector, no exploited component, no payload description, no persistence mechanism and no observed impact in the material. What follows is what the source does establish, and where it stops.

Affected versions, as listed by CERT-FR:

The fifteen Mattermost bulletins referenced are MMSA-2026-00720, 00721, 00740, 00743, 00744, 00745, 00746, 00749, 00750, 00751, 00753, 00755, 00780, 00784 and 00785, all dated 19 October 2026 and all pointing to https://mattermost.com/security-updates/. CERT-FR does not map any bulletin to a specific version branch, so which of the four fixed releases closes which issue is not stated in the source and must be read from the Mattermost bulletins directly.

The only vulnerability-class information in the related material is from BSI, which describes the set as exploitable by a remote authenticated attacker to bypass security controls, disclose confidential information, or cause a denial-of-service condition (https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3361). That is a single-source characterisation and is not corroborated by CERT-FR, which lists the risk as unspecified. It is consistent with the affected product being an authenticated collaboration platform, but it should not be treated as a confirmed vulnerability taxonomy.

One related item does carry a concrete mechanism. GitHub advisory GHSA-6hxm-w4hv-vgvw (Mattermost MMSA-2026-00665) describes a missing role-management authorization check when setting the scheme_admin flag on group syncable link and patch endpoints, allowing a user with group-link permissions to escalate themselves and group members to team or channel admin through crafted API requests. That advisory covers 11.6.x up to 11.6.1, 11.5.x up to 11.5.4 and 10.11.x up to 10.11.15/10.11.16, which are older branches than the four in this item, and it is not one of the fifteen bulletins CERT-FR lists. It is included here as an example of the class of flaw that has recently affected this product (privilege escalation through group-sync API endpoints), not as a description of what 11.7.12, 11.8.6, 11.10.3 or 11.11.2 fix. Do not assume the scheme_admin issue is present or absent in the branches covered by this advisory without checking the Mattermost bulletins.

A separate CERT-FR advisory, CERTFR-2026-AVI-1338 (19 October 2026), covers a single Mattermost Server vulnerability fixed in 11.7.12 and references MMSA-2026-00709 dated 16 October 2026. That bulletin is not in the fifteen listed here, so the 11.7.12 release appears to close both that earlier issue and part of this batch. CERTFR-2026-AVI-1190 (16 September 2026) records an earlier Mattermost Server batch that included a confidentiality impact. Neither adds technical detail.

No exploitation in the wild is reported by any source in this set. No CVE identifiers are given, so no NVD record, EPSS score or CISA KEV status can be checked. Absence from KEV cannot be confirmed either, because there is no CVE to look up.

4. Mitigation & containment

P1, within 24 hours. Inventory every Mattermost Server instance and record its exact version. The version is exposed at the /api/v4/system/ping endpoint and in the about dialog; confirm against the running binary rather than a configuration record. Any instance on 11.11.x below 11.11.2, 11.10.x below 11.10.3, 11.8.x below 11.8.6 or 11.7.x below 11.7.12 is in scope. Upgrade to the fixed release for its branch, or move to 11.11.2 as the current line. Follow the Mattermost upgrade notes for the database migration step before restarting; do not skip the migration on a production cluster.

P1, within 24 hours. Read the fifteen Mattermost bulletins at https://mattermost.com/security-updates/ and record, per bulletin, the CVE (if any), the CVSS score, the affected branches and the vulnerability class. CERT-FR does not provide this mapping and the severity of this batch cannot be assessed without it. Where a bulletin names a CVE, check NVD, EPSS and CISA KEV at that point and re-prioritise.

P2, within 72 hours. Restrict network exposure of the Mattermost web and API endpoints to the corporate network and VPN. If any instance is internet-facing, put it behind an authenticating reverse proxy and rate-limit /api/v4/ paths. The BSI characterisation of the flaws as requiring an authenticated attacker means unauthenticated exposure is the higher-risk configuration, but that characterisation is single-sourced.

P2, within 72 hours. Review Mattermost audit logs and web server access logs for the period since 19 October 2026 for anomalous use of group-sync and admin endpoints, particularly PUT and PATCH requests to /api/v4/group_syncables and /api/v4/groups paths carrying a scheme_admin field. This is a precaution based on the GHSA-6hxm-w4hv-vgvw mechanism in older branches, not on a confirmed exploitation of this batch.

P3, within 7 days. Where an instance cannot be upgraded inside the P1 window, disable group sync (System Console, Group Sync settings) and remove group-link permissions from all non-administrator roles until the upgrade completes. Confirm that no account holds team or channel admin rights it did not have before 19 October 2026.

P3, within 7 days. Add Mattermost Server version to the asset inventory feed used for patch tracking, so that the next CERT-FR advisory on this product can be actioned without a manual sweep.

5. Indicators of compromise

No indicators of compromise available in the source material. No hashes, domains, IP addresses, file paths or command lines are given by CERT-FR, BSI or the GitHub advisory for this batch.

Behavioural indicators, from the GHSA-6hxm-w4hv-vgvw mechanism in older branches only. These are not confirmed as applicable to the versions in this advisory.

6. Detection

Insufficient indicators to author detection rules. The sources give no distinctive strings, command-line flags, mutex names, file paths, registry keys or hard-coded values for the vulnerabilities in this batch. A rule built on the product name or the MMSA identifiers would detect reporting about the issue, not the issue.

The one usable artefact in the related material is the scheme_admin field in the GHSA-6hxm-w4hv-vgvw mechanism, which is documented for older branches. A Sigma rule on that field would detect the older-branch escalation, not this batch, and is therefore not emitted here.

7. Sources

• ANSSI France CERT-FR, "Multiples vulnérabilités dans Mattermost Server" (CERTFR-2026-AVI-1344), 20 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1344/
• ANSSI France CERT-FR, "Vulnérabilité dans Mattermost Server" (CERTFR-2026-AVI-1338), 19 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1338/
• ANSSI France CERT-FR, "Multiples vulnérabilités dans les produits Mattermost" (CERTFR-2026-AVI-1328), 16 October 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1328/
• ANSSI France CERT-FR, "Multiples vulnérabilités dans Mattermost Server" (CERTFR-2026-AVI-1190), 16 September 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1190/
• ANSSI France CERT-FR, "Multiples vulnérabilités dans Mattermost Desktop App" (CERTFR-2026-AVI-1040), 18 August 2026. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1040/
• BSI, "Mattermost Server: Mehrere Schwachstellen" (WID-SEC-2026-3361). https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3361
• GitHub Security Advisories, GHSA-6hxm-w4hv-vgvw (Mattermost MMSA-2026-00665). https://github.com/advisories/GHSA-6hxm-w4hv-vgvw
• Mattermost, security updates index (MMSA-2026-00720 through MMSA-2026-00785, 19 October 2026). https://mattermost.com/security-updates/

8. Adverse Trace position

Adverse Trace assesses this as an unquantified patch item, not a scored vulnerability. No CVE, no CVSS score, no EPSS value and no CISA KEV status can be cited because the source provides none, and the BSI characterisation of the flaw classes is single-sourced. We will not assign a severity to a batch whose contents are unspecified by the vendor. Clients running Mattermost Server on any of the four affected branches should treat the upgrade as a P1 operational action on the basis that fifteen security bulletins were issued at once and the vendor has published fixes, and should read the Mattermost bulletins to establish per-issue severity before deciding whether incident-response escalation is warranted. We will monitor the Mattermost security updates page for CVE assignment and for any revision to the fifteen bulletins, and will reissue this advisory with scored detail if CVE identifiers, CVSS scores or KEV entries appear. Clients who cannot upgrade inside 24 hours should contact us to discuss interim group-sync restrictions.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.