Mattermost up to 11.5.1 Gitlab Plugin authorization

Summaryinfo

A vulnerability classified as problematic has been found in Mattermost up to 11.5.1. This impacts an unknown function of the component Gitlab Plugin. Performing a manipulation results in authorization. This vulnerability is identified as CVE-2026-3117. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mattermost up to 11.5.1. It has been classified as problematic. This affects some unknown processing of the component Gitlab Plugin. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on availability. The summary by CVE is:

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}} or the {{/gitlab webhook {option}}} commands. Mattermost Advisory ID: MMSA-2026-00600

The weakness was released by daw10. The advisory is shared at mattermost.com. This vulnerability is uniquely identified as CVE-2026-3117 since 02/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 10.11.14, 11.4.4, 11.5.2 or 11.6.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1154). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Mattermost Mattermost

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 10.11.0
• 10.11.1
• 10.11.2
• 10.11.3
• 10.11.4
• 10.11.5
• 10.11.6
• 10.11.7
• 10.11.8
• 10.11.9
• 10.11.10
• 10.11.11
• 10.11.12
• 10.11.13
• 10.13.0
• 10.13.1
• 10.13.2
• 10.13.3
• 10.13.4
• 10.13.5
• 10.13.6
• 10.13.7
• 10.13.8
• 10.13.9
• 10.13.10
• 10.13.11
• 11.1.0
• 11.1.1
• 11.1.2
• 11.1.3
• 11.1.4
• 11.1.5
• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.5.0
• 11.5.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion