CVE-2026-4265: Mattermost fails to validate team-specific upload_file permissions

March 16, 2026 (updated March 18, 2026)

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post files in channels where they lack upload_file permission via uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team. Mattermost Advisory ID: MMSA-2025-00553

References

github.com/advisories/GHSA-xpvf-6qcc-9jqc
github.com/mattermost/mattermost
github.com/mattermost/mattermost/commit/c7f6efdfb035490f494b3177996ee5f4b278c988
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-4265

Code Behaviors & Features

Detect and mitigate CVE-2026-4265 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →