Executive brief
Mattermost, a collaboration and messaging platform, contains a security flaw in its GitHub integration. An authenticated user can manipulate the authorization process to gain unauthorized access to private code repositories. This could lead to the exposure of sensitive intellectual property or internal source code.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Mattermost's OAuth implementation. The application fails to properly validate the OAuth token scope during the callback phase of the GitHub authorization flow. A remote, authenticated attacker can exploit this by modifying the 'scope' parameter in the GitHub authorization URL. Successful exploitation allows the attacker to escalate their privileges within the integration to access private repositories they should not have permission to view. The issue is resolved in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.
Affected products
- Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14
Timeline
- 2026-05-22: advisory: Initial disclosure by Mattermost
- 2026-05-22: disclosed