Is CVE-2026-6046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6046 being exploited in the wild.

How severe is CVE-2026-6046?

Medium severity, with a CVSS score of 5.3, published 12 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260428151657-c79c3831061a; and 1 more.

Is there a fix for CVE-2026-6046?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260428151657-c79c3831061a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6046 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-6046?

Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6046: Mattermost message interception via predictable bot usernames

CVE-2026-6046 · Severity: medium · CVSS 5.3 · Published 2026-06-12

Mattermost, a team collaboration and messaging platform, fails to validate that usernames assigned during bot registration actually belong to bot accounts rather than human users. An unprivileged attacker can exploit this by pre-registering a regular user account with a predictable bot username, allowing them to intercept private messages that plugins intended to send through direct message channels. This enables eavesdropping on sensitive plugin-to-user communications without authorization.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-6046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6046 being exploited in the wild.
How severe is CVE-2026-6046?: Medium severity, with a CVSS score of 5.3, published 12 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260428151657-c79c3831061a; and 1 more.
Is there a fix for CVE-2026-6046?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260428151657-c79c3831061a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6046 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-6046?: Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
```
github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260428151657-c79c3831061a or later
```
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260428151657-c79c3831061a
```

Technical details

The vulnerability stems from insufficient validation in the bot registration process (specifically the EnsureBot/EnsureBotUser function). During bot creation, if a username conflicts with an existing non-bot user account, the system fails to detect this mismatch and may return the human user's ID instead of rejecting the operation. An attacker with basic user account creation privileges can pre-register a regular account using a predictable bot service username (e.g., a plugin's well-known bot name), and when a plugin attempts to register its bot with that same username, the system incorrectly associates plugin communications with the attacker's human account. The attacker then receives direct messages intended only for the plugin bot. The fix validates that returned usernames correspond to actual bot accounts and returns an error on conflict, requiring patches in versions 11.6.1, 11.5.5, 10.11.17, and later.

Affected products

Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 10.11.0 to 10.11.16

Identifiers

CVE-2026-6046
GHSA-3vmp-whvv-5v9v
GO-2026-6279

Timeline

2026-06-12: disclosed: Vulnerability disclosed via GHSA and CVE-2026-6046
2026-04-28: patched: Fix merged in PR #36064; patches released in versions 11.6.1, 11.5.5, 10.11.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.