CVE-2026-4858
Medium
Elevated severity or exploit probability.
CVSS base
8.0
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.3%
26.1th percentile
CISA KEV
Not listed
Weakness / dates
CWE-22
Published 2026-05-21 · modified 2026-07-23
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
| Attack Vector | N | Network |
| Attack Complexity | H | High |
| Privileges Required | L | Low |
| User Interaction | R | Required |
| Scope | C | Changed |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | H | High |
Timeline
- 2026-05-21 — Published (NVD)
- 2026-07-23 — Last modified (NVD)
Description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640