CVE-2026-28735: Mattermost incorrect OAuth token scope validation in GitHub integration

CVE-2026-28735 · Severity: medium · CVSS 5.4 · Published 2026-05-22

Mattermost, a collaboration and messaging platform, contains a security flaw in its GitHub integration. An authenticated user can manipulate the authorization process to gain unauthorized access to private code repositories. This could lead to the exposure of sensitive intellectual property or internal source code.

Technologies: github.com/mattermost/mattermost-plugin-github (Go), github.com/mattermost/mattermost-server (Go), Mattermost GitHub Plugin, Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-28735 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-28735 being exploited in the wild.
How severe is CVE-2026-28735?
Medium severity, with a CVSS score of 5.4, published 22 May 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-plugin-github (Go) SEMVER:introduced=0,fixed=1.0.1-0.20260318132218-6e6b740c4852; github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; Mattermost GitHub Plugin < 1.0.1-0.20260318132218-6e6b740c4852; Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14.
Is there a fix for CVE-2026-28735?
Yes. github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260318132218-6e6b740c4852 or later; github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28735 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28735?
Check whether you run github.com/mattermost/mattermost-plugin-github (Go), github.com/mattermost/mattermost-server (Go), Mattermost GitHub Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260318132218-6e6b740c4852 or later
    go get github.com/mattermost/mattermost-plugin-github@v1.0.1-0.20260318132218-6e6b740c4852
  • github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.6.1+incompatible

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Mattermost's OAuth implementation. The application fails to properly validate the OAuth token scope during the callback phase of the GitHub authorization flow. A remote, authenticated attacker can exploit this by modifying the 'scope' parameter in the GitHub authorization URL. Successful exploitation allows the attacker to escalate their privileges within the integration to access private repositories they should not have permission to view. The issue is resolved in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.

Affected products

  • Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14

Identifiers

  • CVE-2026-28735
  • GHSA-r5vf-grcx-5vqp
  • GO-2026-5839

Timeline

  • 2026-05-22: advisory: Initial disclosure by Mattermost
  • 2026-05-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.