Changeflow GovPing Data Privacy & Cybersecurity Mattermost Server Vulnerability, 4 Affected Ver...
Priority review Notice Added Final

Mattermost Server Vulnerability, 4 Affected Versions

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published a security advisory (CERTFR-2026-AVI-0459) on 20 April 2026 alerting that a vulnerability exists in Mattermost Server across four version ranges: 10.11.x < 10.11.15, 11.4.x < 11.4.5, 11.5.x < 11.5.4, and 11.6.x < 11.6.1. The vulnerability allows an attacker to cause an unspecified security issue, per Mattermost security bulletin MMSA-2026-00640. CERT-FR directs affected parties to consult the vendor's security update page for patches.

“Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.”

— CERT-FR , verbatim from source
Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .
View original document View source feed page

What changed

CERT-FR published a new security advisory documenting an unspecified vulnerability in Mattermost Server across four version ranges. No CVE, CVSS score, or technical details beyond the affected version numbers are provided by the source. The only recommended action is to refer to Mattermost's own security bulletin and apply available patches.

Organisations running self-hosted Mattermost instances should audit their installed version immediately and update to 10.11.15, 11.4.5, 11.5.4, or 11.6.1 (or later) as applicable. Since no technical description of the exploit is given in the source, security teams should treat the Mattermost security bulletin as the authoritative reference for remediation steps.

What to do next

  1. Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs

Archived snapshot

Apr 20, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 20 avril 2026 N° CERTFR-2026-AVI-0459 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Mattermost Server

Gestion du document

| Référence | CERTFR-2026-AVI-0459 |
| Titre | Vulnérabilité dans Mattermost Server |
| Date de la première version | 20 avril 2026 |
| Date de la dernière version | 20 avril 2026 |
| Source(s) | Bulletin de sécurité Mattermost MMSA-2026-00640 du 17 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • Mattermost Server versions 10.11.x antérieures à 10.11.15
  • Mattermost Server versions 11.4.x antérieures à 11.4.5
  • Mattermost Server versions 11.5.x antérieures à 11.5.4
  • Mattermost Server versions 11.6.x antérieures à 11.6.1

Résumé

Une vulnérabilité a été découverte dans Mattermost Server. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 20 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Mattermost Server Multiple Vulnerabilities - Data Integrity, CSRF, Policy Bypass
Priority review Apr 16, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Xen Data Confidentiality Vulnerability (xsa488, CVE-2025-54505)
Priority review Apr 20, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Moxa Industrial Ethernet Switches Security Policy Bypass Vulnerability
Routine Apr 20, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 20th, 2026
Instrument
Notice
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
CERTFR-2026-AVI-0459

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability disclosure Software patching
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Topics
Data Privacy

Browse Categories

Agriculture & Food Safety 73 Banking & Finance 402 Consumer Protection 87 Courts & Legal 408 Data Privacy & Cybersecurity 84 Defense & National Security 53 Education 55 Energy 100 Environment 151 Gaming 2 Government & Legislation 428 Healthcare 15 Healthcare & Life Sciences 372 Immigration 10 Insurance 74 Labor & Employment 132 Pharma & Drug Safety 21 Professional Licensing 7 Real Estate & Housing 76 Securities & Markets 149 Tax 76 Telecom & Technology 50 Trade & Sanctions 141 Transportation 91

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!