CVE-2026-4646: Mattermost doesn't validate user-supplied input in API request handlers

May 26, 2026 (updated June 29, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint. Mattermost Advisory ID: MMSA-2026-00638

References

github.com/advisories/GHSA-rmvv-8v8w-rf7x
github.com/mattermost/mattermost-plugin-github/commit/c2840e980b3c2bd08db656eaa6a0fe26bcbf4695
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-4646

Code Behaviors & Features

Detect and mitigate CVE-2026-4646 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →