CVE-2026-86348— MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
Quick assessment
Affected
Mattermost Mattermost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost 11.9版本、11.0.9版本、11.4.8版本、11.7.7版本和10.22.11.0版本存在处理逻辑错误漏洞，该漏洞源于未能从处理程序崩溃中恢复，可能导致经过身份验证的用户通过带有意外字段类型的post-action请求使插件崩溃。
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mattermost | Mattermost | <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0≤ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 |
affected |
11.10.0 |
unaffected | ||
11.9.1 |
unaffected | ||
11.8.5 |
unaffected | ||
11.7.8 |
unaffected | ||
10.11.23 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86348
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process
Source: CVE Program / CVE List V5
Vulnerability Description
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的类型转换
Source: CVE Program / CVE List V5
Vulnerability Title
Mattermost 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mattermost是美国Mattermost公司开源的一个开源协作平台。 Mattermost 11.9版本、11.0.9版本、11.4.8版本、11.7.7版本和10.22.11.0版本存在处理逻辑错误漏洞，该漏洞源于未能从处理程序崩溃中恢复，可能导致经过身份验证的用户通过带有意外字段类型的post-action请求使插件崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 ~ <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 | - |
|
II. Public POCs for CVE-2026-86348
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86348
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-09-14 · 16 CVEs total
| CVE-2026-8821 | 7.1 HIGH | Playbooks run owner channel membership permission bypass |
| CVE-2026-12985 | 6.8 MEDIUM | Mattermost DCR redirect URI allowlist bypass via improper URL component validation |
| CVE-2026-15814 | 6.5 MEDIUM | Uploading a crafted image causes excessive memory allocation in the Mattermost Server |
| CVE-2026-9812 | 6.5 MEDIUM | Missing property field ownership validation in Playbooks run property update endpoint |
| CVE-2026-5132 | 6.5 MEDIUM | Unbounded zlib decompression in Calls SDP WebSocket messages |
| CVE-2026-91181 | 6.5 MEDIUM | Data Retention Teams Endpoint Leaks Private Team Invite ID |
| CVE-2026-82920 | 5.5 MEDIUM | Mattermost ABAC parent policy bypass via policy update endpoint |
| CVE-2026-10556 | 5.3 MEDIUM | Unauthenticated webhook request with null notification entry could crash the Microsoft Cal |
| CVE-2026-10542 | 5.0 MEDIUM | Playbooks channel action update validation issue |
| CVE-2026-11993 | 4.3 MEDIUM | Fix authenticated members disabling file content indexing server-wide via extraction pool |
| CVE-2026-14344 | 4.3 MEDIUM | Inconsistent authorization checks in Mattermost Boards endpoints |
| CVE-2026-14259 | 4.3 MEDIUM | Board archive import bypasses team board creation permissions |
| CVE-2026-12882 | 4.3 MEDIUM | Mattermost Markdown autolink parsing denial of service |
| CVE-2026-13417 | 4.3 MEDIUM | Boards plugin denial of service via unvalidated block fields.properties |
| CVE-2026-86349 | 4.3 MEDIUM | Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting |
IV. Related Vulnerabilities
Same product: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same vendor: Mattermost
-
CVE-2026-93851
Path traversal in Mattermost Agents plugin mention reminder -
CVE-2026-93846
Team admin can escalate a team member's permissions via the -
CVE-2026-93848
Mattermost OpenID discovery endpoint request bypasses outbou -
CVE-2026-93850
Unbounded memory consumption during PDF text extraction -
CVE-2026-93849
Mattermost allows authenticated users to trigger excessive m
Same weakness: CWE-704
-
CVE-2026-104634
beam_mcp: JSON boolean and null tool arguments reach dispatc -
CVE-2026-104420
Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped -
CVE-2026-20249
Cisco Secure Firewall Adaptive Security Appliance and Secure -
CVE-2026-87546
Google Chrome 处理逻辑错误漏洞 -
CVE-2026-69585
Microsoft Windows Search Component Elevation of Privilege Vu