CVE-2026-16049
Received Received - Intake

Mattermost GitLab Plugin URL Injection Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Mattermost, Inc.

Description
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-16049
EUVD
EUVD-2026-60209

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost gitlab_plugin to 11.8 (inc)
mattermost gitlab_plugin to 10.20.11 (inc)
mattermost gitlab_plugin to 11.5.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Mattermost GitLab plugin versions up to 11.8, 10.20.11, and 11.5.7.0 have a flaw where channel permissions are not verified when processing API requests with a user-supplied post_id. Additionally, the web_url parameter is not validated against the configured GitLab instance. This allows an authenticated attacker to inject bot-authored messages with arbitrary URLs into restricted channels via the createIssue and attachCommentToIssue API endpoints.

Detection Guidance

This vulnerability can be detected by checking Mattermost plugin versions and reviewing API logs for unauthorized channel access attempts. Verify if the GitLab plugin version is <=11.8, 10.20.11, or 11.5.7.0. Look for suspicious API calls to createIssue or attachCommentToIssue endpoints with mismatched channel permissions or external URLs.

Impact Analysis

An attacker could send malicious links to users in channels they are not authorized to access. This could lead to phishing attacks, malware distribution, or unauthorized access to sensitive information if users click on the injected links.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Update the Mattermost GitLab plugin to a version higher than 11.8, 10.20.11, or 11.5.7.0 to address the permission and URL validation flaws. Restrict API endpoint access to authorized users only and review channel permissions for bot-authored messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart