Changeflow GovPing Data Privacy & Cybersecurity Mattermost Server Vulnerability Advisory, Multi...
Priority review Guidance Added Final

Mattermost Server Vulnerability Advisory, Multiple Versions Affected

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published a security advisory on April 23, 2026 regarding vulnerabilities discovered in Mattermost Server, referencing seven Mattermost security bulletins dated April 22, 2026. The vulnerabilities affect Mattermost Server versions 10.11.x prior to 10.11.15, 11.4.x prior to 11.4.5, 11.5.x prior to 11.5.4, and 11.6.x prior to 11.6.1. The risk level is not specified by the vendor. Organizations using Mattermost Server should consult the referenced vendor security bulletins to obtain and apply the necessary patches.

Why this matters

Organisations running Mattermost Server should verify their installed version against the affected version ranges listed. Given that CERT-FR has issued a public advisory covering seven vendor bulletins simultaneously, this suggests multiple concurrent vulnerabilities may exist — patch priority should be assessed against the server's exposure to untrusted network access.

AI-drafted from the source document, validated against GovPing's analyst note standards . For the primary regulatory language, read the source document .
Published by CERT-FR on cert.ssi.gouv.fr . Detected, standardized, and enriched by GovPing. Review our methodology and editorial standards .

About this source

CERT-FR is the French government's national cybersecurity incident response team, run by the ANSSI. Their advisory feed publishes vulnerability disclosures, active exploitation warnings, and emergency patching guidance for software in widespread enterprise use: browsers, hypervisors, ERP systems, network equipment, file transfer products. Around 180 advisories a month. The advisories are written in French but cover the same vulnerability universe as CISA, NCSC-UK, BSI's CERT-Bund, and JPCERT, often hours earlier on European-headquartered vendors. Watch this if you patch enterprise software, run a SOC, write detection content, or track Schneider, Dassault, OVH, Atos, or any French-vendor advisory faster than English-language sources will surface it. GovPing publishes each advisory with the affected vendor, severity, and CERT-FR link.

View original document View source feed page

What changed

The advisory identifies multiple vulnerabilities in Mattermost Server spanning four version branches. No specific CVSS score or risk category is provided by the vendor. Organizations running Mattermost Server should identify their current version and cross-reference against the affected version ranges listed. The recommended action is to obtain patches directly from Mattermost's security updates page, as referenced in the seven bulletins from April 22, 2026. Unlike advisories that specify severity ratings, affected parties must independently assess risk based on their deployment context and exposure.

Implications: Organizations using Mattermost Server for team communication should prioritize inventory of current server versions and monitor for available patches via https://mattermost.com/security-updates/. Since no severity rating is provided, security teams should treat this as a Priority review item and apply patches in accordance with their standard vulnerability management SLAs. The lack of vendor-specified risk information may require internal threat assessment.

What to do next

  1. Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs

Archived snapshot

Apr 23, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 23 avril 2026 N° CERTFR-2026-AVI-0485 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Vulnérabilité dans Mattermost Server

Gestion du document

| Référence | CERTFR-2026-AVI-0485 |
| Titre | Vulnérabilité dans Mattermost Server |
| Date de la première version | 23 avril 2026 |
| Date de la dernière version | 23 avril 2026 |
| Source(s) | Bulletin de sécurité Mattermost MMSA-2026-00620 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00626 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00638 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00641 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00646 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00647 du 22 avril 2026
Bulletin de sécurité Mattermost MMSA-2026-00648 du 22 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risque

  • Non spécifié par l'éditeur

Systèmes affectés

  • Mattermost Server versions 10.11.x antérieures à 10.11.15
  • Mattermost Server versions 11.4.x antérieures à 11.4.5
  • Mattermost Server versions 11.5.x antérieures à 11.5.4
  • Mattermost Server versions 11.6.x antérieures à 11.6.1

Résumé

Une vulnérabilité a été découverte dans Mattermost Server. Elle permet à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 23 avril 2026 Version initiale

Parties

Mattermost

Related changes

Favicon for www.cert.ssi.gouv.fr Mattermost Server Vulnerability Affecting Versions Before 11.5.2
Priority review Apr 21, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Python Vulnerability CVE-2026-3298 Advisory
Priority review Apr 22, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr CPython Security Policy Bypass Vulnerability
Priority review Apr 23, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 23rd, 2026
Instrument
Guidance
Branch
Executive
Source language
fr
Legal weight
Non-binding
Stage
Final
Change scope
Minor
Document ID
CERTFR-2026-AVI-0485

Who this affects

Applies to
Technology companies Government agencies
Industry sector
5112 Software & Technology
Activity scope
Vulnerability patching Server software updates Cybersecurity incident response
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Software & Technology

Browse Categories

Agriculture & Food Safety 79 AI Regulation 3 Banking & Finance 475 Consumer Protection 120 Courts & Legal 454 Data Privacy & Cybersecurity 134 Defense & National Security 52 Education 64 Energy 113 Environment 164 Gaming 2 Government & Legislation 479 Healthcare 15 Healthcare & Life Sciences 383 Immigration 11 Insurance 87 Labor & Employment 182 Pharma & Drug Safety 21 Professional Licensing 6 Real Estate & Housing 74 Securities & Markets 169 Tax 104 Telecom & Technology 50 Trade & Sanctions 159 Transportation 115

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!