Vulnerabilities CVE-2026-4858

CVE-2026-4858

High

Open

TLP:CLEAR

Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

Details

CVSS Score: 8.0
EPSS Score ⓘ: 0.33%

25.5th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Confidence: 90%
Published: May 21, 2026
Last Modified: May 22, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.