CVE-2026-28741
CSRF Vulnerability in Mattermost Authentication Endpoint Allows Account Manipulation
Publication date: 2026-04-15
Last updated on: 2026-04-22
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.13 (exc) |
| mattermost | mattermost_server | From 11.3.0 (inc) to 11.3.3 (exc) |
| mattermost | mattermost_server | From 11.4.0 (inc) to 11.4.3 (exc) |
| mattermost | mattermost_server | From 11.5.0 (inc) to 11.5.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Mattermost to a version later than the affected versions: versions greater than 10.11.12 for the 10.11.x branch, greater than 11.5.0 for the 11.5.x branch, greater than 11.4.2 for the 11.4.x branch, and greater than 11.3.2 for the 11.3.x branch.
Additionally, be cautious of phishing attempts that may trick users into visiting malicious pages that exploit the CSRF vulnerability.
Can you explain this vulnerability to me?
This vulnerability exists in certain versions of Mattermost where the application fails to validate CSRF (Cross-Site Request Forgery) tokens on an authentication endpoint.
Because of this failure, an attacker can trick a user into visiting a malicious webpage that performs unauthorized actions on the user's behalf, specifically updating the user's authentication method without their consent.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized changes to a user's authentication method, potentially allowing attackers to bypass security controls or gain unauthorized access.
Since the vulnerability has a CVSS base score of 6.8 with high impact on confidentiality and integrity, it can compromise sensitive user information and affect the trustworthiness of the authentication process.