{"id":"EUVD-2026-38246","enisaUuid":"6668f5c0-f6af-3b13-9d62-95211dd14ab8","description":"Mattermost versions 11.7.x \u003c\u003d 11.7.0, 11.6.x \u003c\u003d 11.6.2, 11.5.x \u003c\u003d 11.5.5, 10.11.x \u003c\u003d 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect \u003cinstance-name\u003e}} slash command.. Mattermost Advisory ID: MMSA-2026-00644","datePublished":"Jun 22, 2026, 1:34:21 PM","dateUpdated":"Jun 22, 2026, 3:39:29 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-5139\nGHSA-2g8v-grq3-hq2g\n","assigner":"Mattermost","epss":0.29,"enisaIdProduct":[{"id":"1918c863-f2bc-3ab0-a3ff-affcd0e10f13","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.17"},{"id":"25572ef7-aa78-3b71-ad84-8d086f0eb58b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.7.0 ≤11.7.0"},{"id":"7cc3dbfa-a09a-30fe-bfa3-bb590b20fa86","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.5"},{"id":"c4aec668-4900-3ae3-a676-d56fc9d5bd9c","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.6.0 ≤11.6.2"}],"enisaIdVendor":[{"id":"abe8bdba-ed21-323f-ad03-de3948e41c84","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"2bab9632-1f07-317e-938f-2077cd6058f8","vulnerability":{"id":"GHSA-2g8v-grq3-hq2g","description":"Mattermost doesn\u0027t enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler","datePublished":"Jun 22, 2026, 3:30:45 PM","dateUpdated":"Sep 15, 2026, 7:51:08 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-5139\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-38246\n","aliases":"GHSA-2g8v-grq3-hq2g\nCVE-2026-5139\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"4315af4e-da01-3e29-879c-249e5c593a5f","vulnerability":{"id":"CVE-2026-5139","description":"Mattermost versions 11.7.x \u003c\u003d 11.7.0, 11.6.x \u003c\u003d 11.6.2, 11.5.x \u003c\u003d 11.5.5, 10.11.x \u003c\u003d 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect \u003cinstance-name\u003e}} slash command.. Mattermost Advisory ID: MMSA-2026-00644","datePublished":"Jun 22, 2026, 1:34:21 PM","dateUpdated":"Jun 22, 2026, 3:39:29 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-38246\n","assigner":"Mattermost","epss":0.29,"dataProcessed":"Nov 1, 2026, 7:17:47 AM","vulnerabilityProduct":[{"id":"26e4de7d-f509-32bb-a801-c5b37398cd69","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.5"},{"id":"28a94419-5a6f-3bdf-a944-1331f7be8f70","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.17"},{"id":"6ca183c5-6268-3765-b49e-273a348f945b","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.6.0 ≤11.6.2"},{"id":"fa5e6a14-8cc0-3e6a-8153-7fb388e0f87e","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.7.0 ≤11.7.0"}],"vulnerabilityVendor":[{"id":"b0cc3d0e-821b-36d7-b2f3-ed0b8a6a5ade","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[{"id":"e6091b80-54e0-34ac-b6f6-26e63d45c499","advisory":{"id":"WID-SEC-W-2026-1650","description":"Mattermost (Desktop, Server und Mobile): Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und um Informationen offenzulegen.","datePublished":"May 21, 2026, 10:00:00 PM","dateUpdated":"Jun 22, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1650.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1650\n","aliases":"CVE-2026-5139\nCVE-2026-6062\nCVE-2026-6673\nCVE-2026-8074\nCVE-2026-9162\nCVE-2026-22880\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"045ff5e9-3f1d-3c92-8cd0-565c8159f629","product":{"name":"Mobile 11.2.4","vendor":{"name":"Mattermost"}}},{"id":"1d71fd2c-c928-344b-8a5d-ccb1d54a6f55","product":{"name":"Mobile 11.4.1","vendor":{"name":"Mattermost"}}},{"id":"2bfc9749-c058-34de-bf77-5b9cc0c05a47","product":{"name":"Desktop 5.13.6","vendor":{"name":"Mattermost"}}},{"id":"30688ff1-384e-3c71-a1d5-fa5c2cb4cf86","product":{"name":"Server 10.11.18","vendor":{"name":"Mattermost"}}},{"id":"37bbab54-c644-3aa3-9744-26d6cb6c96c0","product":{"name":"Server 11.8.0","vendor":{"name":"Mattermost"}}},{"id":"4416cb31-70cc-3d15-a124-c0513d362f0b","product":{"name":"Server 11.5.6","vendor":{"name":"Mattermost"}}},{"id":"454a0923-72d1-37f0-b403-f4dd704db903","product":{"name":"Mobile 11.3.2","vendor":{"name":"Mattermost"}}},{"id":"676261fa-2829-3ca3-9f41-cafb82d413e0","product":{"name":"Desktop 6.2","vendor":{"name":"Mattermost"}}},{"id":"a54bfb9b-aa46-3312-bc74-fb9147b36916","product":{"name":"Server 11.7.1","vendor":{"name":"Mattermost"}}},{"id":"aa5885e2-904e-37ae-a5dd-72c6df3a70e4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}},{"id":"af2891e9-a84c-33ec-9805-ee41d0a9685e","product":{"name":"Server 11.6.3","vendor":{"name":"Mattermost"}}},{"id":"e867a6ad-9099-3c9e-ad3b-e00fd460c213","product":{"name":"Mobile 11.5","vendor":{"name":"Mattermost"}}},{"id":"ea9213c9-883c-3b43-9edc-853cb0356bef","product":{"name":"Mobile 2.38","vendor":{"name":"Mattermost"}}},{"id":"eb5afb78-2ac2-369f-8423-2a533cea8dd8","product":{"name":"Mobile 10.11.12","vendor":{"name":"Mattermost"}}},{"id":"fa3ed92f-2e97-3eb6-af5d-98a9b4d900bf","product":{"name":"Mobile 2.37.1","vendor":{"name":"Mattermost"}}}]}}]}