CVE-2026-16049

_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Assigner: Mattermost
Reserved: 17.07.2026 Published: 17.08.2026 Updated: 17.08.2026

Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied {{post_id}}, and fails to validate the {{web_url}} parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the {{createIssue}} and {{attachCommentToIssue}} API endpoints. Mattermost Advisory ID: MMSA-2026-00673

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.9

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Mattermost
Product	Mattermost
Versions	Default: unaffected affected from 0 to 10.20.11 (incl.) affected from 0 to 11.5.7 (incl.) Version 11.9.0 is unaffected Version 10.11.21 is unaffected Version 11.7.6 is unaffected

Vendor

Mattermost

Product

Mattermost

Versions

Default: unaffected

affected from 0 to 10.20.11 (incl.)
affected from 0 to 11.5.7 (incl.)
Version 11.9.0 is unaffected
Version 10.11.21 is unaffected
Version 11.7.6 is unaffected

Solutions

Update Mattermost Plugins to versions 11.9.0, 10.11.21, 11.7.6 or higher.

Credits

MindFlare007 finder

References

Problem Types

CWE-862: Missing Authorization CWE