CVE-2026-28735

EPSS 0.14%
Veröffentlicht 22.05.2026 16:26:04
Zuletzt bearbeitet 23.07.2026 16:10:00
Erkennungen
Login

GitHub OAuth Scope Validation

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 4 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mattermost ≫ Mattermost Server Version >= 10.11.0 < 10.11.15

Mattermost ≫ Mattermost Server Version >= 11.4.0 < 11.4.5

Mattermost ≫ Mattermost Server Version >= 11.5.0 < 11.5.4

Mattermost ≫ Mattermost Server Version >= 11.6.0 < 11.6.1

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.14%	0.035

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
responsibledisclosure@mattermost.com	5.4	2.8	2.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://mattermost.com/security-updates

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-28735

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-28735

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-28735

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-28735