Executive brief
Mattermost is a team collaboration platform similar to Slack. The GitLab integration allows connecting Mattermost to GitLab for CI/CD workflows. This vulnerability allows any authenticated user to change the global default GitLab instance configuration by executing a slash command, even if they lack administrator privileges. An attacker could redirect the entire organization's GitLab integration to a malicious instance, potentially intercepting CI/CD credentials or causing operational disruption.
Technical details
This is a missing authorization (CWE-862) vulnerability in Mattermost's GitLab integration command handler. The /gitlab connect slash command invokes a setDefaultInstance function that changes the global GitLab instance configuration, but fails to validate that the executing user holds administrator privileges. An authenticated attacker with network access can exploit this via the /gitlab connect <instance-name> slash command to overwrite the organization's default GitLab instance, potentially redirecting integration traffic to an attacker-controlled server. No user interaction is required beyond command execution. The vulnerability is patched in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.
Affected products
- Mattermost Mattermost Server >=11.7.0, <11.7.1; >=11.6.0, <11.6.3; >=11.5.0, <11.5.6; >=10.11.0, <10.11.18
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Patches released: versions 11.7.1, 11.6.3, 11.5.6, 10.11.18