Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0 Webhook Attachment unusual condition

Summaryinfo

A vulnerability was found in Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0. It has been rated as problematic. This affects an unknown part of the component Webhook Attachment Handler. The manipulation leads to unusual condition. This vulnerability is uniquely identified as CVE-2026-4915. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Mattermost up to 10.11.14/11.4.4/11.5.3/11.6.0 and classified as problematic. This issue affects an unknown function of the component Webhook Attachment Handler. The manipulation with an unknown input leads to a unusual condition vulnerability. Using CWE to declare the problem leads to CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. Impacted is availability. The summary by CVE is:

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641

The weakness was disclosed by daw10. The advisory is shared at mattermost.com. The identification of this vulnerability is CVE-2026-4915 since 03/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 10.11.15, 11.4.5, 11.5.4, 11.6.1 or 11.7.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31646). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Groupware Software

Name

• Mattermost

Version

• 10.11.0
• 10.11.1
• 10.11.2
• 10.11.3
• 10.11.4
• 10.11.5
• 10.11.6
• 10.11.7
• 10.11.8
• 10.11.9
• 10.11.10
• 10.11.11
• 10.11.12
• 10.11.13
• 10.11.14
• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.5
• 11.5.0
• 11.5.1
• 11.5.2
• 11.5.3
• 11.6.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion