CVE-2026-2463

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation, allowing an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals such as [::ffff:127.0.0.1].

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 failed to properly enforce read permissions in search API endpoints. Guest users without read permissions could access posts and files in channels via search API requests.

Mattermost versions 10.11.x <= 10.11.10 fail to validate the user's authentication method when processing an account auth type switch. An authenticated attacker can change the account password without confirmation by falsely claiming a different auth provider.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command. An authenticated team member can enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions, allowing a guest user to post files in channels where they lack upload_file permission by uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team.

Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion, allowing channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Advisory ID: MMSA-2026-00579.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels, allowing a removed team member to enumerate all public channels within a private team via the channel search API endpoint.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata. An authenticated attacker can spoof permalink embeds impersonating other users via crafted PUT requests to the post update API endpoint.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to limit the size of responses from integration action endpoints. An authenticated attacker can cause server memory exhaustion and denial of service via a malicious integration server returning an arbitrarily large response when a user clicks an interactive message button.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to bound memory allocation when processing PSD image files, allowing an authenticated attacker to cause server memory exhaustion and denial of service by uploading a specially crafted PSD file.