Executive brief
Mattermost, a collaboration and messaging platform, contains a security flaw in how it handles integration URLs. A malicious user with a standard account could exploit this to perform actions as a system administrator, potentially leading to full control over the platform and access to sensitive corporate communications. Organizations should update to the latest patched versions to prevent unauthorized administrative access.
Technical details
A path traversal vulnerability (CWE-22) exists in Mattermost Server's handling of integration action URLs. The application fails to properly validate or sanitize these URLs, allowing a malicious authenticated user to inject traversal sequences. By doing so, the attacker can redirect requests to internal API endpoints. Because these requests may be processed using a system administrator's authentication token, the attacker can achieve a privilege escalation to call arbitrary administrative APIs. The exploit requires low privileges but involves high complexity and some user interaction. Patches are available in versions 11.6.1, 11.5.4, 11.4.5, and 10.11.15.
Affected products
- Mattermost Mattermost Server 11.6.0, 11.5.0 to 11.5.3, 11.4.0 to 11.4.4, 10.11.0 to 10.11.14
Timeline
- 2026-05-21: disclosed
- 2026-05-21: advisory
- 2026-06-23: patched