CVE-2026-5139: Mattermost missing authorization in GitLab connect command

CVE-2026-5139 · Severity: medium · CVSS 5.4 · Published 2026-06-22

Mattermost is a team collaboration platform similar to Slack. The GitLab integration allows connecting Mattermost to GitLab for CI/CD workflows. This vulnerability allows any authenticated user to change the global default GitLab instance configuration by executing a slash command, even if they lack administrator privileges. An attacker could redirect the entire organization's GitLab integration to a malicious instance, potentially intercepting CI/CD credentials or causing operational disruption.

Technologies: github.com/mattermost/mattermost-server (Go), Mattermost, Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-5139 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-5139 being exploited in the wild.
How severe is CVE-2026-5139?
Medium severity, with a CVSS score of 5.4, published 22 June 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17; Mattermost Server >=11.7.0, <11.7.1; >=11.6.0, <11.6.3; >=11.5.0, <11.5.6; >=10.11.0, <10.11.18.
Is there a fix for CVE-2026-5139?
Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5139 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5139?
Check whether you run github.com/mattermost/mattermost-server (Go), Mattermost or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.7.1+incompatible

Technical details

This is a missing authorization (CWE-862) vulnerability in Mattermost's GitLab integration command handler. The /gitlab connect slash command invokes a setDefaultInstance function that changes the global GitLab instance configuration, but fails to validate that the executing user holds administrator privileges. An authenticated attacker with network access can exploit this via the /gitlab connect &lt;instance-name&gt; slash command to overwrite the organization's default GitLab instance, potentially redirecting integration traffic to an attacker-controlled server. No user interaction is required beyond command execution. The vulnerability is patched in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.

Affected products

  • Mattermost Mattermost Server >=11.7.0, <11.7.1; >=11.6.0, <11.6.3; >=11.5.0, <11.5.6; >=10.11.0, <10.11.18

Identifiers

  • CVE-2026-5139
  • GHSA-2g8v-grq3-hq2g
  • GO-2026-6480

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database
  • 2026-06-22: patched: Patches released: versions 11.7.1, 11.6.3, 11.5.6, 10.11.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.