Executive brief
Mattermost Server fails to properly handle unexpected data types in post-action requests, allowing an authenticated user to crash the plugin. This results in temporary unavailability of the affected plugin functionality until the server is restarted, disrupting team communication and collaboration features.
Technical details
The vulnerability exists in Mattermost's post-action handler, which does not properly recover from panics when processing requests containing unexpected field types. An authenticated user can craft a malicious post-action request with an invalid field type to trigger an unhandled panic in the handler, causing the plugin to crash. The attack requires valid authentication credentials and network access to the Mattermost instance. Affected versions include 11.9 and earlier, with specific vulnerable releases: 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0. The vendor has released patches; users should upgrade to patched versions to remediate the issue.
Affected products
- Mattermost Mattermost Server <=11.9 including 11.0.9, 11.4.8, 11.7.7, 10.22.11.0
Timeline
- 2026-09-14: disclosed