CVE-2026-26233 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-26233 PUBLISHED CVSS 4.300000190734863 MEDIUM

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

Risk Scores

CVSS v3.1

4.300000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected Products

Vendor	Product	Versions
mattermost	mattermost_server	10.11.0, 11.4.0, 10.11.0
github.com	mattermost/mattermost-server	11.3.0-rc1, 11.2.0-rc1, 10.11.0-rc1
Mattermost	Mattermost	11.4.0, 11.2.0, 10.11.0

Timeline

Feb 24, 2026 CVE Published
Mar 25, 2026 Coalition ESS Score
Mar 25, 2026 PoC Published
Mar 25, 2026 PoC Published
Mar 26, 2026 CVE Updated
Mar 26, 2026 PoC Published
Mar 26, 2026 Security Advisory
Mar 29, 2026 Security Advisory

References

https://mattermost.com/security-updates/ advisory
MMSA-2025-00566 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-26233 advisory
https://github.com/mattermost/mattermost package

Open in Interactive Console →