Mattermost Security Updates (AV26-1104)
Mattermost has released a security advisory addressing multiple vulnerabilities affecting versions up to 11.10.0 and earlier maintenance releases.
Triage facts
Revision 1- Applicability
- Mattermost (<= 11.10.0), Mattermost (<= 11.9.2) +2
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 29, 15:52 UTC
- Source quality
- A6Roughly even chance
The Canadian Centre for Cyber Security (CCCS) has issued an advisory regarding security vulnerabilities in Mattermost. The affected versions include releases up to and including 11.10.0, 11.9.2, 11.8.6, and 11.7.11. As of the time of publication, technical details regarding the specific nature of the vulnerabilities remain undisclosed in the CCCS advisory. Users and administrators are advised to monitor the official Mattermost Security Updates portal for patches.
Recommendation
- Inventory all Mattermost server instances within the environment.
- Review the Mattermost Security Updates documentation for specific vulnerability details and patch availability.
- Apply the latest security patches to all affected versions (11.10.0 and earlier) immediately upon release.
Immediate actions
Inventory Mattermost deployments and prepare for version upgrades
Mitigations
Patch Mattermost instances to the latest secure version once released
Mattermost versions <= 11.10.0