Changeflow GovPing Data Privacy & Cybersecurity Mattermost Server Multiple Vulnerabilities - Da...
Priority review Notice Added Final

Mattermost Server Multiple Vulnerabilities - Data Integrity, CSRF, Policy Bypass

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published security advisory CERTFR-2026-AVI-0446 identifying 20 multiple vulnerabilities in Mattermost Server affecting versions 10.11.x before 10.11.14, 11.3.x before 11.3.3, 11.4.x before 11.4.4, and 11.5.x before 11.5.2. Exploitation could result in data integrity compromise, CSRF injection, and security policy bypass. Refer to vendor security bulletins for patches.

Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .
View original document View source feed page

What changed

CERT-FR issued a security advisory consolidating 20 vulnerability disclosures affecting Mattermost Server across four version branches. The vulnerabilities enable data integrity attacks, CSRF injection, and security policy bypass. Affected versions include 10.11.x before 10.11.14, 11.3.x before 11.3.3, 11.4.x before 11.4.4, and 11.5.x before 11.5.2. Five CVEs are referenced (CVE-2026-27769, CVE-2026-28741, CVE-2026-3590, CVE-2026-4265, CVE-2026-4274).

Organizations running affected Mattermost Server deployments should immediately refer to the vendor's security update page to obtain and apply the appropriate patches. Failure to patch could expose communications, user data, and system integrity to remote attackers exploiting CSRF vectors or policy bypass conditions.

What to do next

  1. Refer to Mattermost security bulletin for patches at mattermost.com/security-updates/

Archived snapshot

Apr 16, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 16 avril 2026 N° CERTFR-2026-AVI-0446 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Mattermost Server

Gestion du document

| Référence | CERTFR-2026-AVI-0446 |
| Titre | Multiples vulnérabilités dans Mattermost Server |
| Date de la première version | 16 avril 2026 |
| Date de la dernière version | 16 avril 2026 |
| Source(s) | Bulletin de sécurité Mattermost MMSA-2026-00603 du 16 mars 2026
Bulletin de sécurité Mattermost MMSA-2026-00624 du 16 mars 2026
Bulletin de sécurité Mattermost MMSA-2026-00625 du 16 mars 2026
Bulletin de sécurité Mattermost MMSA-2025-00552 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00570 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00573 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00575 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00576 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00582 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00591 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00597 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00605 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00607 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00608 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00614 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00622 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00627 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00630 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00631 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00636 du 15 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00645 du 15 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à l'intégrité des données
  • Contournement de la politique de sécurité
  • Injection de requêtes illégitimes par rebond (CSRF)
  • Non spécifié par l'éditeur

Systèmes affectés

  • Mattermost Server versions 10.11.x antérieures à 10.11.14
  • Mattermost Server versions 11.3.x antérieures à 11.3.3
  • Mattermost Server versions 11.4.x antérieures à 11.4.4
  • Mattermost Server versions 11.5.x antérieures à 11.5.2

Résumé

De multiples vulnérabilités ont été découvertes dans Mattermost Server. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à l'intégrité des données, une injection de requêtes illégitimes par rebond (CSRF) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 16 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach
Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Google Chrome
Priority review Apr 16, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Cisco ISE and Webex Products
Priority review Apr 16, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 16th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0446

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Security vulnerability advisory Software patching
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Artificial Intelligence

Browse Categories

Agriculture & Food Safety 65 AI Regulation 3 Banking & Finance 332 Consumer Protection 63 Courts & Legal 361 Data Privacy & Cybersecurity 77 Defense & National Security 51 Education 44 Energy 100 Environment 86 Environmental & Energy 37 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 278 Government Operations 107 Healthcare 142 Healthcare & Life Sciences 72 Housing 16 Immigration 8 Immigration & Border Control 2 Insurance 66 Labor & Employment 126 Legal & Judicial 30 Pharma & Drug Safety 101 Pharma & Healthcare 1 Public Health 2 Real Estate & Housing 59 Sanctions & Export Controls 1 Securities & Investments 28 Securities & Markets 103 Securities Regulation 6 Tax 64 Tax & Revenue 9 Telecom & Technology 47 Trade & Commerce 3 Trade & Sanctions 135 Transportation 85

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!