CVE-2026-4915: Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing

May 26, 2026 (updated June 30, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry. Mattermost Advisory ID: MMSA-2026-00641

References

github.com/advisories/GHSA-5gmf-x7hg-97wf
github.com/mattermost/mattermost/commit/faa7d75b4ea041701e97948f8aa1332e3626a39a
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-4915

Code Behaviors & Features

Detect and mitigate CVE-2026-4915 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →