Mattermost Inc. — CraftedSignal Threat Feed

Mattermost Uncontrolled Resource Consumption Vulnerability (CVE-2026-5308)

hello@craftedsignal.io — Tue, 26 May 2026 13:30:45 +0000

A denial-of-service vulnerability, identified as CVE-2026-5308, affects Mattermost servers. Specifically, versions 11.6.x up to and including 11.6.0, 11.5.x up to and including 11.5.3, 11.4.x up to and including 11.4.4, and 10.11.x up to and including 10.11.14, do not properly enforce request body size limits on plugin HTTP endpoints. This flaw allows a remote, unauthenticated attacker to potentially exhaust server resources by sending specially crafted, oversized HTTP requests to plugin endpoints, leading to service disruption. This vulnerability is tracked under Mattermost Advisory ID MMSA-2026-00646 and has a CVSS v3.1 base score of 7.5.

Attack Chain

The attacker identifies a vulnerable Mattermost server running a susceptible version.
The attacker identifies plugin HTTP endpoints that lack proper request body size limit enforcement.
The attacker crafts an oversized HTTP request targeted at one of the vulnerable plugin endpoints.
The malicious HTTP request is sent to the Mattermost server.
The Mattermost server processes the request, allocating resources without proper size validation.
Repeated or concurrent oversized requests exhaust server resources such as memory and CPU.
Legitimate user requests are delayed or fail due to resource exhaustion.
The Mattermost service becomes unavailable, resulting in a denial of service.

Impact

Successful exploitation of CVE-2026-5308 can result in a complete denial of service, preventing legitimate users from accessing the Mattermost platform. The impact is significant for organizations relying on Mattermost for communication and collaboration, potentially disrupting business operations. The severity is further underscored by the CVSS v3.1 base score of 7.5, highlighting the potential for widespread impact.

Recommendation

Upgrade to a patched version of Mattermost Server that addresses CVE-2026-5308.
Implement the Sigma rule “Detect CVE-2026-5308 Exploitation Attempt via Large HTTP Request” to identify potential exploitation attempts.
Monitor web server logs for unusually large HTTP requests targeting plugin endpoints, as this could indicate an attempted denial-of-service attack.
Configure web application firewalls (WAFs) to enforce request body size limits, mitigating the vulnerability at the network level.

Mattermost File Access Vulnerability (CVE-2026-3473)

hello@craftedsignal.io — Tue, 26 May 2026 13:30:28 +0000

Mattermost, a popular open-source collaboration platform, is vulnerable to an authorization bypass issue. CVE-2026-3473 affects Mattermost Server versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14. This vulnerability stems from a failure to properly validate file ownership and access control. An authenticated user can exploit this flaw to gain unauthorized access to and download files belonging to other users or teams. The attack is carried out via crafted Boards API requests utilizing valid file IDs. This vulnerability is identified by Mattermost Advisory ID MMSA-2026-00620. Successful exploitation can lead to sensitive data exposure and potential compromise of confidential information within the Mattermost environment.

Attack Chain

An attacker authenticates to a vulnerable Mattermost server.
The attacker identifies a valid file ID belonging to another user or team.
The attacker crafts a malicious Boards API request.
The crafted API request includes the valid file ID of the target file.
The vulnerable Mattermost server fails to properly validate file ownership and access control.
The server processes the request without proper authorization checks.
The server grants the attacker access to the file.
The attacker successfully downloads the file.

Impact

Successful exploitation of CVE-2026-3473 allows an authenticated user to access and download files belonging to other users or teams within the Mattermost instance. This could lead to the unauthorized disclosure of sensitive information, including confidential documents, private communications, and other proprietary data. The impact is significant for organizations that rely on Mattermost for secure internal communication and collaboration. The number of affected installations is currently unknown.

Recommendation

Upgrade Mattermost Server to a patched version (later than 11.6.0, 11.5.3, 11.4.4, or 10.11.14) to remediate CVE-2026-3473 as per the vendor advisory.
Monitor webserver logs for unusual activity related to the Boards API, specifically requests attempting to access files using file IDs (cs-uri-stem|contains: “/api/v1/boards”).
Deploy the Sigma rule provided to detect suspicious access to the Boards API.
Enforce strict file access control policies within Mattermost to limit the potential impact of similar vulnerabilities.