# CVE-2026-28735: Mattermost incorrect OAuth token scope validation in GitHub integration

Source: https://junglewise.ai/threats/cve-2026-28735-mattermost-incorrect-oauth-token-scope-validation-in-github  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-28735 · Severity: medium · CVSS 5.4 · Published 2026-05-22

Mattermost, a collaboration and messaging platform, contains a security flaw in its GitHub integration. An authenticated user can manipulate the authorization process to gain unauthorized access to private code repositories. This could lead to the exposure of sensitive intellectual property or internal source code.

Technologies: [github.com/mattermost/mattermost-plugin-github (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-plugin-github), [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [Mattermost GitHub Plugin](https://junglewise.ai/threats/technologies/github-plugin), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-28735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28735 being exploited in the wild.

**How severe is CVE-2026-28735?** Medium severity, with a CVSS score of 5.4, published 22 May 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-plugin-github (Go) SEMVER:introduced=0,fixed=1.0.1-0.20260318132218-6e6b740c4852; github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.15+incompatible,introduced=11.4.0+incompatible,fixed=11.4.5+incompatible,introduced=11.5.0+incompatible,fixed=11.5.4+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; Mattermost GitHub Plugin < 1.0.1-0.20260318132218-6e6b740c4852; Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14.

**Is there a fix for CVE-2026-28735?** Yes. github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260318132218-6e6b740c4852 or later; github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28735 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-28735?** Check whether you run github.com/mattermost/mattermost-plugin-github (Go), github.com/mattermost/mattermost-server (Go), Mattermost GitHub Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-plugin-github (Go): upgrade to 1.0.1-0.20260318132218-6e6b740c4852 or later

  ```sh
  go get github.com/mattermost/mattermost-plugin-github@v1.0.1-0.20260318132218-6e6b740c4852
  ```

- github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later

  ```sh
  go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in Mattermost's OAuth implementation. The application fails to properly validate the OAuth token scope during the callback phase of the GitHub authorization flow. A remote, authenticated attacker can exploit this by modifying the 'scope' parameter in the GitHub authorization URL. Successful exploitation allows the attacker to escalate their privileges within the integration to access private repositories they should not have permission to view. The issue is resolved in versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, and 10.11.15.

## Affected products

- Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14

## Identifiers

- CVE-2026-28735
- GHSA-r5vf-grcx-5vqp
- GO-2026-5839

## Timeline

- 2026-05-22: advisory: Initial disclosure by Mattermost
- 2026-05-22: disclosed

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)