CVE-2026-16049
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Mattermost GitLab plugin (versions <=11.8, 10.20.11, 11.5.7.0) fails to verify channel permissions when processing API requests with a caller-supplied post_id, and fails to validate the web_url parameter against the configured GitLab instance. This allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the createIssue and attachCommentToIssue API endpoints.
Risk Assessment
The risk includes unauthorized sending of messages to channels the attacker does not have access to, potentially leading to phishing or spreading malicious content within the organization.
Recommendation
Upgrade the Mattermost GitLab plugin to a version that fixes this vulnerability (as per vendor recommendations).
Original NVD description (English source)
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673