Communication and Collaboration

In Mattermost versions 11.7.6 and earlier, and 10.11.21 and earlier a medium severity vulnerability CVE-2026-16046 was detected. This vulnerability allows a run participant to modify the details of completed playbook runs. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16046.

In Mattermost versions 11.7.x <= 11.7.6 and 10.11.x <= 10.11.21 a medium severity vulnerability CVE-2026-16044 was detected. This vulnerability allows a board member to escalate a guest user to Board Admin by importing a crafted archive file. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16044.

In Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 a medium severity vulnerability CVE-2026-16044 was detected. This vulnerability allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. To address this issue, users should upgrade Mattermost to version 10.11.22 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-16044.

In Mattermost versions 11.7.6 and earlier, and 11.8.3 and earlier a medium severity vulnerability CVE-2026-15754 was detected. This vulnerability allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team. To address this issue, users should upgrade Mattermost to version 11.7.7 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15754.

In Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier a medium severity vulnerability CVE-2026-14298 was detected. This vulnerability allows an authenticated user to cause a denial of service. To address this issue, users should upgrade Mattermost to version 10.11.23 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-14298.

In Django versions 5.2 before 5.2.17 and 6.0 before 6.0.8 (with earlier unsupported versions potentially affected) a high severity vulnerability CVE-2026-15307 was detected. This vulnerability allows an attacker to perform arbitrary server-side file writes and Server-Side Request Forgery (SSRF), potentially leading to Remote Code Execution (RCE). This occurs because GeoDjango spatial lookups optimistically parse right-hand-side values as a raster by passing them to the django.contrib.gis.gdal.GDALRaster constructor. If untrusted input reaches this constructor—for example, via a spatial-field filter submitted through the Django admin changelist by a user with view permissions—the system can be exploited. Passing a dictionary or its JSON string representation causes it to be opened in write mode regardless of default settings, allowing the creation of files with attacker-chosen names and contents via a file-backed GDAL driver. Additionally, passing other string values can trigger outbound network requests through GDAL virtual filesystem handlers. To address this issue, users should upgrade Django to versions 5.2.17, 6.0.8, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-15307.

In Mattermost versions 11.8.0 and earlier, 11.7.3 and earlier, 11.6.5 and earlier, and 10.11.20 and earlier a medium severity vulnerability CVE-2026-7521 was detected. This vulnerability allows an administrator to delete arbitrary files on the server. To address this issue, users should upgrade Mattermost to version 10.11.21 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7521.

In EGroupware affected versions a high severity vulnerability CVE-2026-27823 was detected. This vulnerability allows an authenticated attacker to execute arbitrary commands on the server. To address this issue, users should upgrade EGroupware to the latest available version. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27823.

In Mattermost versions 10.11.18 and earlier, 11.6.3 and earlier, and 11.5.6 and earlier a low severity vulnerability CVE-2026-3472 was detected. This vulnerability allows an authenticated attacker to exfiltrate data. To address this issue, users should upgrade Mattermost to version 10.11.19 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3472.