Detections
Analytics

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

medium Nessus Plugin ID 350090

Language:

Synopsis

The remote host is affected by multiple vulnerabilities.

Description

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories.

 - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to a plugin endpoint. Mattermost Advisory ID: MMSA-2026-00775. (CVE-2026-96260)

 - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints. Mattermost Advisory ID: MMSA-2026-00776. (CVE-2026-96259)

 - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a crafted request to POST /api/v4/posts/ids/reactions. Mattermost Advisory ID: MMSA-2026-00771. (CVE-2026-95666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Mattermost Server version 11.7.11, 11.8.6, 11.9.2, 11.10.2, 11.11.0 or later.

See Also

https://docs.mattermost.com/security-guide/security-updates

https://mattermost.com/security-updates/

Plugin Details

Severity: Medium

ID: 350090

File Name: mattermost_server_MMSA-2026-00771_00775_00776.nasl

Version: 1.2

Type: Remote

Family: CGI abuses

Published: 9/25/2026

Updated: 9/28/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.61

CVSS v2

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 3.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N

CVSS Score Source: CVE-2026-96259

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mattermost:mattermost_server

Required KB Items: installed_sw/Mattermost Server

Exploit Ease: No known exploits are available

Patch Publication Date: 9/22/2026

Vulnerability Publication Date: 9/22/2026

Reference Information

CVE: CVE-2026-95666, CVE-2026-96259, CVE-2026-96260

IAVA: 2026-A-1047