Executive brief
Mattermost is a team collaboration platform with calendar integration capabilities. An unauthenticated attacker can send a specially crafted request to the public webhook endpoint, causing the Microsoft Calendar plugin to crash and denying calendar services to all users on the instance. This impacts business continuity for teams relying on integrated calendar functionality.
Technical details
The vulnerability stems from insufficient validation of null entries in Microsoft Graph webhook notification payloads within the Microsoft Calendar plugin. An unauthenticated attacker can craft a POST request to the public webhook endpoint with malformed payload data containing null values, triggering an unhandled exception that crashes the plugin process. The attack requires no authentication and network-only access to the webhook endpoint. Successful exploitation results in a denial of service condition affecting calendar integration across the entire Mattermost instance. Updates are available for affected versions.
Affected products
- Mattermost Mattermost Server 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22
Timeline
- 2026-09-14: disclosed: CVE-2026-10556 published; MMSA-2026-00693