Github.Com Mattermost Mattermost-Plugin-Msteams vulnerabilities

CVE-2026-24661 [MEDIUM] CWE-770 Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint Mattermost MS Teams plugin doesn't limit the request body size on the /changes webhook endpoint Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-006

CVE-2026-21388 [LOW] CWE-770 Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion and denial of service via sending an oversized JSON payload. Mattermost Advisory ID: MMSA-2026-00

CVE-2025-27936 [MEDIUM] CWE-208 Mattermost vulnerable to Observable Timing Discrepancy Mattermost vulnerable to Observable Timing Discrepancy Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison.

CVE-2026-2476 [HIGH] CWE-200 Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values Mattermost Microsoft Teams Plugin fails to properly mask sensitive configuration values Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support packets to obtain original plugin settings via exported configuration data. Mattermost Advisory ID: MMSA-2026-00606