Mattermost Updates Fix OAuth SSRF and Plugin Route Denial of Service
Tech GuruQuick Answer
Mattermost fixes two separate flaws: a System Administrator can direct OAuth requests to internal addresses, and an authenticated user can exhaust memory through a plugin request. Update each affected branch to 11.7.11, 11.8.6, 11.9.2 or 11.10.2, or follow the supported path to 11.11.0.
Confirm Scope And Apply The Supported Fix
What to do now: Record every server's release branch, OAuth endpoint configuration and plugin exposure. Deploy the matching fixed build across the cluster, then verify sign-in and plugin workflows.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Mattermost 11.7 through 11.10 release streams |
|---|---|
| Advisory | MMSA-2026-00776 / MMSA-2026-00775 |
| CVEs | CVE-2026-96259, CVE-2026-96260 |
| Fix release date and CVE publication | Vendor fix date: 2026-09-22. CVE-2026-96259 record published 2026-09-22 20:34:20.872 UTC. |
| CVE-2026-96260 record publication | 2026-09-22 20:34:49.141 UTC |
| Affected versions | Mattermost 11.7.0–11.7.10, 11.8.0–11.8.5, 11.9.0–11.9.1, and 11.10.0–11.10.1 |
| Fixed version | Mattermost 11.7.11, 11.8.6, 11.9.2, 11.10.2, or 11.11.0 |
| CVSS base score | 5.5 / 6.5 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2026-96259 bypasses the internal-connection filter for administrator-configured OAuth token and userinfo endpoints, allowing requests to internal addresses and disclosure of responses. CVE-2026-96260 reads plugin request bodies without a size limit during CSRF validation; a logged-in user can consume server memory. Neither advisory describes these as unauthenticated attacks.
What To Validate Now
- Inventory. Locate Mattermost 11.7 through 11.10 release streams deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Mattermost 11.7.0–11.7.10, 11.8.0–11.8.5, 11.9.0–11.9.1, and 11.10.0–11.10.1 Do not infer applicability from product family or severity alone.
- Remediate. Apply Mattermost 11.7.11, 11.8.6, 11.9.2, 11.10.2, or 11.11.0 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Check each node's version, successful OAuth sign-in and plugin behavior. Use controlled destinations and bounded test requests to verify internal-address filtering and request-body rejection; do not exhaust production memory or probe unrelated internal services.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Keep the fix aligned with the installed release branch and supported upgrade path. Review System Administrator access and outbound OAuth destinations separately from authenticated plugin access. A reverse-proxy limit is not proof that every direct or internal request path is protected; validate the server update.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
