CVE-2026-27656

CWE-3035 documents5 sources
Severity
6.1MEDIUM
EPSS
0.0%
top 91.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Mattermost/mattermost-serverGithub.com Mattermost/mattermost/server/v8Mattermost Mattermost Server+1 more
Timeline
PublishedMar 25

Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to properly validate user identity in the OpenID {{IsSameUser()}} comparison logic, which allows an attacker to take over arbitrary user accounts via an overly permissive substring matching flaw in the user discovery flow.. Mattermost Advisory ID: MMSA-2026-00590

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:NExploitability: 0.5 | Impact: 5.2

Affected Packages4 packages

▶NVDmattermost/mattermost_server10.11.0 — 10.11.12+3
▶Gogithub.com/mattermost/mattermost-server11.4.0-rc1 — 11.4.1+3
▶Gogithub.com/mattermost/mattermost/server/v88.0.0-20260105080200-d27a2195068d — 8.0.0-20260217110922-b7d4a1f1f59b
▶CVEListV5mattermost/mattermost11.4.0 — 11.4.0+3

🔴Vulnerability Details

3
CVEList
Account Takeover via Substring Matching in OpenID Connect Authentication↗2026-03-25
▶
OSV
Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw↗2026-03-25
▶
GHSA
Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw↗2026-03-25
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27656 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-27656 (MEDIUM CVSS 6.1) | Mattermost versions 11.4.x <= 11.4. | cvebase.io