GHSA-fprx-ppqr-8wgf

GHSA-fprx-ppqr-8wgf PUBLISHED CVSS 6.599999904632568 MEDIUM

Record from GitHub Advisory Database · Published March 16, 2026

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528

Risk scores

CVSS 3.1

6.599999904632568

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Timeline

Mar 16, 2026 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fprx-ppqr-8wgf
vulnetix vdb fixes GHSA-fprx-ppqr-8wgf

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fprx-ppqr-8wgf/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →