CVE-2026-10080

MediumCVSS 6.5

Published: 17/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate WebSocket command field types, allowing an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.

Risk Assessment

Risk of denial of service for Boards users, impacting availability.

Recommendation

Upgrade Mattermost to a patched version as per advisory MMSA-2026-00687.

Original NVD description (English source)

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.. Mattermost Advisory ID: MMSA-2026-00687