CVE-2026-6341— Incomplete group locking implementation
Affected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | ≤ 11.1.5 | affected |
≤ 10.13.11 | affected | ||
≤ 11.3.4 | affected | ||
11.6.0 | unaffected | ||
11.5.2 | unaffected | ||
10.11.14 | unaffected | ||
11.4.4 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-6341
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incomplete group locking implementation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to have API-level checks on which groups the user can create issues or attach comments to which allows a user that is member of multiple groups to create issues to a locked group via direct API requests. Mattermost Advisory ID: MMSA-2026-00602
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Mattermost Plugins 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost Plugins是美国Mattermost公司的一个插件，提供强大的功能延伸和与服务器和网络/桌面应用程序都紧密整合。 Mattermost Plugins 11.5版本、11.1.5版本、10.13.11版本和11.3.4.0版本存在安全漏洞，该漏洞源于缺乏API级别的检查，可能导致属于多个组的用户通过直接API请求向锁定组创建问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 0 ~ 11.1.5 | - |
II. Public POCs for CVE-2026-6341
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-6341
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-05-18 · 21 CVEs total
| CVE-2026-6346 | 8.7 HIGH | Sensitive credentials exposed in plaintext in Mattermost support packets |
| CVE-2026-6347 | 7.6 HIGH | Mattermost Calls plugin exposes TURN server credentials in plaintext in support packets |
| CVE-2026-6345 | 6.5 MEDIUM | Prevent password disclosure and force reset during Slack import |
| CVE-2026-5163 | 6.5 MEDIUM | Missing authorization check in AI message rewrite endpoint allows access to private thread |
| CVE-2026-3117 | 6.5 MEDIUM | Instance and webhook GitLab plugin commands were able to be run by non-admin users |
| CVE-2026-3471 | 6.5 MEDIUM | Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop |
| CVE-2026-28759 | 4.3 MEDIUM | Insufficient authorization in shared channel membership sync allows remote cluster to remo |
| CVE-2026-2325 | 4.3 MEDIUM | Improper Input Validation in MS Teams Meetings API Handler |
| CVE-2026-3637 | 4.3 MEDIUM | Mattermost fails to enforce create_post permission when editing posts |
| CVE-2026-6342 | 4.3 MEDIUM | Group prefix matching bypass for subscriptions |
| CVE-2026-6340 | 4.3 MEDIUM | Memory Exhaustion via Malicious 7zip File Upload |
| CVE-2026-6339 | 4.3 MEDIUM | Missing request origin validation on burn-on-read reveal endpoint |
| CVE-2026-6343 | 4.3 MEDIUM | Mattermost Playbooks Plugin fails to enforce view permissions in list endpoints, allowing |
| CVE-2026-28732 | 4.3 MEDIUM | Slash command trigger-word update allowed command hijacking |
| CVE-2026-3495 | 3.8 LOW | Unescaped variables during error page composition |
| CVE-2026-4273 | 3.7 LOW | Insufficient token rotation validation in remote cluster invite confirmation |
| CVE-2026-6333 | 3.5 LOW | SSRF via Host Header Spoofing in Custom Slash Commands |
| CVE-2026-4643 | 3.5 LOW | Calling window.close() from server-side content causes crash in the Mattermost Desktop App |
| CVE-2026-6334 | 3.1 LOW | OAuth authorization code client binding not enforced during token redemption in Mattermost |
| CVE-2026-4286 | 3.1 LOW | Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member |
IV. Related Vulnerabilities
Same product: Mattermost
- CVE-2026-3471
Opening a window with {{javascript:alert()}} as URL causes c - CVE-2026-4643
Calling window.close() from server-side content causes crash - CVE-2026-6333
SSRF via Host Header Spoofing in Custom Slash Commands - CVE-2026-6345
Prevent password disclosure and force reset during Slack imp - CVE-2026-6346
Sensitive credentials exposed in plaintext in Mattermost sup
Same vendor: Mattermost
- CVE-2026-3471
Opening a window with {{javascript:alert()}} as URL causes c - CVE-2026-4643
Calling window.close() from server-side content causes crash - CVE-2026-6333
SSRF via Host Header Spoofing in Custom Slash Commands - CVE-2026-6345
Prevent password disclosure and force reset during Slack imp - CVE-2026-6346
Sensitive credentials exposed in plaintext in Mattermost sup
Same weakness: CWE-863
- CVE-2026-34579
MantisBT has an authorization bypass via private issue monit - CVE-2026-42526
Apache Airflow Amazon provider: Prevent unauthorized access - CVE-2026-41470
LIVE555 < 2026.04.22 RTSP Server Authorization Bypass via Se - CVE-2026-42096
Broken Access Control in Sparx Pro Cloud Server - CVE-2026-21789
HCL Connections is vulnerable to broken access control
V. Comments for CVE-2026-6341
No comments yet