CVE-2026-2457
Mattermost allows attackers to spoof permalink embeds
Record from NVD · Published February 15, 2026
github.com/mattermost/mattermost/server/v8 is fixed in 8.0.0-20260123211116-9efe617be8b8 and 8.0.0-20260123211116 (Go Modules)
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.. Mattermost Advisory ID: MMSA-2025-00569
EPSS 0.11% · 1.3th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/mattermost/mattermost/server/v8 | Go Modules | 8.0.0-20260123211116-9efe617be8b8, 8.0.0-20260123211116 |
| mattermost_server | mattermost | 11.3.1, 11.2.3, 10.11.11 |
| Mattermost | Mattermost | 11.2.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| mattermost | mattermost_server | 10.11.0, 11.2.0, 11.3.0 |
Timeline
- Feb 15, 2026 CVE Published
- Feb 16, 2026 PoC Published
- Mar 16, 2026 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 CVE Updated
- Mar 19, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-2457
vulnetix vdb fixes CVE-2026-2457Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-2457/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart