Communication and Collaboration

In Mattermost versions 11.10.1 and earlier, 11.9.1 and earlier, 11.8.5 and earlier, and 11.7.10 and earlier a medium severity vulnerability CVE-2026-95666 was detected. This vulnerability allows an authenticated user to cause excessive database load. To address this issue, users should upgrade Mattermost to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-95666.

In Mattermost versions 6.2.2.0 and earlier a low severity vulnerability CVE-2026-12284 was detected. This vulnerability allows a malicious server to disconnect a user’s active call. To address this issue, users should upgrade Mattermost to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-12284.

In Open Notebook versions before 1.11.0 a high severity vulnerability CVE-2026-90769 was detected. This vulnerability allows authenticated users to perform server-side requests to internal services. To address this issue, users should upgrade Open Notebook to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-90769.

In Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 a medium severity vulnerability CVE-2026-16044 was detected. This vulnerability allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16044.

In Mattermost versions 11.7.6 and earlier, and 11.8.3 and earlier a medium severity vulnerability CVE-2026-15754 was detected. This vulnerability allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team. To address this issue, users should upgrade Mattermost to version 11.7.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15754.

In Mattermost versions 11.7.6 and earlier, and 10.11.21 and earlier a medium severity vulnerability CVE-2026-16046 was detected. This vulnerability allows a run participant to modify the details of completed playbook runs. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16046.

In Mattermost versions 11.7.x <= 11.7.6 and 10.11.x <= 10.11.21 a medium severity vulnerability CVE-2026-16044 was detected. This vulnerability allows a board member to escalate a guest user to Board Admin by importing a crafted archive file. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16044.

In Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier a medium severity vulnerability CVE-2026-14298 was detected. This vulnerability allows an authenticated user to cause a denial of service. To address this issue, users should upgrade Mattermost to version 10.11.23 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-14298.

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.