CVE-2026-27656: GO-2026-5360 - Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/matt

CVE-2026-27656 · Severity: low · CVSS 3.1 · Published 2026-06-25

Technologies: github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), github.com/mattermost/mattermost-server (Go). Vendors: Go.

Executive brief

Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/mattermost-server

Affected products

Go github.com/mattermost/mattermost-server/v5
Go github.com/mattermost/mattermost-server/v6
Go github.com/mattermost/mattermost/server/v8
Go github.com/mattermost/mattermost-server

Related threats

GO-2026-5663 - Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server
GO-2026-5512 - Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost
GO-2026-5629 - Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server
GO-2026-5495 - Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server
GO-2026-5393 - Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server