CVE-2026-86348

published 2026-09-14

CVE-2026-86348: Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a…

Priority P4 22 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I N A L

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701

Affected

5 ranges

Vendor	Product	Version range	Fixed in
mattermost	mattermost	<= <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0	—
mattermost	mattermost_server	>= 10.11.0 < 10.11.23	10.11.23
mattermost	mattermost_server	>= 11.7.0 < 11.7.8	11.7.8
mattermost	mattermost_server	>= 11.8.0 < 11.8.5	11.8.5
mattermost	mattermost_server	>= 11.9.0 < 11.9.1	11.9.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-704