{"id":"EUVD-2026-39661","enisaUuid":"bac7957e-13ef-3bdc-ab58-703998c50bd0","description":"The Mattermost Go module github.com/mattermost/mattermost/server/public versions \u003c v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532","datePublished":"Jun 26, 2026, 1:47:10 PM","dateUpdated":"Jun 26, 2026, 2:39:00 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-13426\nGHSA-72v2-v53v-4qmm\n","assigner":"Mattermost","epss":0.29,"enisaIdProduct":[{"id":"56b70d7f-d1e7-3d30-992a-97369185183b","product":{"name":"github.com/mattermost/mattermost/server/public","vendor":{"name":"Mattermost"}},"product_version":"v0.0.0 \u003cv0.1.22"}],"enisaIdVendor":[{"id":"8ca9beb8-c683-378d-91c9-023a4e2501fe","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"68bd99d3-558b-3d8f-a797-e5d93fd7d53f","vulnerability":{"id":"CVE-2026-13426","description":"The Mattermost Go module github.com/mattermost/mattermost/server/public versions \u003c v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532","datePublished":"Jun 26, 2026, 1:47:10 PM","dateUpdated":"Jun 26, 2026, 2:39:00 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-39661\n","assigner":"Mattermost","epss":0.29,"dataProcessed":"Nov 3, 2026, 7:19:23 AM","vulnerabilityProduct":[{"id":"9f51aacc-523d-362f-8acc-7dbf51dd883b","product":{"name":"github.com/mattermost/mattermost/server/public","vendor":{"name":"Mattermost"}},"product_version":"v0.0.0 \u003cv0.1.22"}],"vulnerabilityVendor":[{"id":"b46c7340-3c36-3c0e-b849-55a53dfbfe5b","vendor":{"name":"Mattermost"}}]}},{"id":"9f165f76-15aa-30d0-8735-691bc97bcd52","vulnerability":{"id":"GHSA-72v2-v53v-4qmm","description":"The Mattermost Go module github.com/mattermost/mattermost/server/public versions \u003c v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532","datePublished":"Jun 26, 2026, 3:32:13 PM","dateUpdated":"Jun 26, 2026, 3:32:14 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-13426\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-39661\n","aliases":"GHSA-72v2-v53v-4qmm\nCVE-2026-13426\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"e6f75bcf-d093-3bba-bcf7-5b05685fd984","advisory":{"id":"WID-SEC-W-2026-2107","description":"Mattermost Server: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Mattermost Server ausnutzen, um Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder andere, nicht näher spezifizierte Angriffe durchzuführen.","datePublished":"Jun 28, 2026, 10:00:00 PM","dateUpdated":"Jul 13, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2107.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-2107\n","aliases":"CVE-2026-13426\nCVE-2026-9597\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"0e770c96-f987-3070-9efa-e2bb99d1da46","product":{"name":"11.6.6","vendor":{"name":"RealObjects"}}},{"id":"0faaf0ee-bac1-331e-b09e-e6f575fb0b42","product":{"name":"11.9.0","vendor":{"name":"NetApp"}}},{"id":"1717ceb5-f83d-305d-a7ef-22fabd62e5a1","product":{"name":"11.8.2","vendor":{"name":"Mattermost"}}},{"id":"7332d226-f7cc-3736-be70-2440a7cacfcf","product":{"name":"11.8.0","vendor":{"name":"Mattermost"}}},{"id":"7e4b9e6a-bea0-3978-a139-973e4d3f5c26","product":{"name":"11.3.1","vendor":{"name":"Oracle"}}},{"id":"ae396812-4c5d-3f60-b062-e5743bbe69ab","product":{"name":"11.7.4","vendor":{"name":"Mattermost"}}},{"id":"badb1f67-9e9f-3b0e-86dd-571aab196a5d","product":{"name":"11.7.3","vendor":{"name":"Mattermost"}}},{"id":"c7b3ae07-44b3-3645-b99d-758090eac601","product":{"name":"11.8.1","vendor":{"name":"Mattermost"}}},{"id":"d9e1fff7-644a-3d5f-963a-47dce4ce32f2","product":{"name":"11.6.5","vendor":{"name":"Mattermost"}}},{"id":"e16fe8a9-11eb-3ea4-9938-266035b56fa7","product":{"name":"11.2.3","vendor":{"name":"MariaDB"}}},{"id":"ef0b2938-e224-3257-91ba-533729e1cbc5","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}},{"id":"ef1b1bb1-ddfb-31cd-a0f4-4df7f9f4e22a","product":{"name":"11.4.0","vendor":{"name":"IBM"}}},{"id":"f46fad9e-86c7-313b-bc99-dc7e906a3bfe","product":{"name":"11.7.5","vendor":{"name":"Mattermost"}}},{"id":"f5a17f64-4f78-3651-97fb-cd1ec09a33c8","product":{"name":"10.11.21","vendor":{"name":"Mattermost"}}}]}}]}