CVE-2026-27659

CWE-352 — Cross-Site Request Forgery (CSRF)5 documents5 sources
Severity
4.6MEDIUM
EPSS
0.0%
top 93.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost/mattermost/server/v8Mattermost Mattermost ServerMattermost Mattermost
Timeline
PublishedMar 25

Description

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 2.1 | Impact: 2.5

Affected Packages3 packages

▶NVDmattermost/mattermost_server10.11.0 — 10.11.11+3
▶Gogithub.com/mattermost/mattermost/server/v811.4.0-rc1 — 11.4.1+4
▶CVEListV5mattermost/mattermost11.2.0 — 11.2.2+3

🔴Vulnerability Details

3
CVEList
CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint↗2026-03-25
▶
GHSA
Mattermost doesn't properly validate CSRF tokens↗2026-03-25
▶
OSV
Mattermost doesn't properly validate CSRF tokens↗2026-03-25
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-27659 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶