Communication and Collaboration

In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a high severity vulnerability CVE-2026-7387 was detected. This vulnerability allows an authenticated user with group-link permissions to escalate their own privileges, as well as the privileges of other group members, to team or channel administrator. This occurs because the application fails to enforce proper role-management authorization checks when setting the scheme_admin flag on group syncable link and patch endpoints. An attacker can exploit this flaw by submitting crafted API requests. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, and 10.11.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7387.

In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a medium severity vulnerability CVE-2026-6689 was detected. This vulnerability allows an authenticated user with team creation permissions to bypass intended access controls and configure invite-related settings. This occurs due to a missing PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the initial team creation process via the POST /api/v4/teams endpoint. While the system properly enforces this check when updating an existing team, this flaw allows a user to create a team that is publicly joinable or restricted to specific domains without having the actual permission to invite users. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, 10.11.17, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6689.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-44783 was detected. This vulnerability allows authenticated users outside of the allowed groups to post unauthorized messages into a topic’s staff-only whisper channel. This occurs due to a flaw in how replies to whisper posts are handled on sites where the whispers feature is enabled. As a result, the injected content becomes visible to authorized whisperers (typically staff members) alongside legitimate whispers. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44783.

In LimeSurvey all versions a high severity vulnerability CVE-2026-50635 was detected. This vulnerability allows a remote, unauthenticated attacker to take over a user’s account. This occurs due to a Host Header Injection flaw where LimeSurvey constructs account password-reset links using the unvalidated, client-supplied HTTP Host header (because the allowedHosts allowlist is undefined in the default configuration). By submitting a forgotten-password request with a spoofed Host header, the attacker causes the system to email a reset link pointing to an attacker-controlled server but containing a genuine validation_key. When the victim or an automated email scanner dereferences the link, the token is disclosed to the attacker, who can then use it on the legitimate site to set a new password. To address this issue, users should upgrade LimeSurvey to version version 7.x or the latest 6.x patch release and ensure the allowedHosts parameter is properly configured. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50635.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-32244 was detected. This vulnerability allows anonymous and unprivileged users to view removed content, leading to information disclosure. This occurs because the platform caches outdated AI-generated summaries which are not adequately purged when the original content is deleted. Consequently, users who lack the permissions to regenerate summaries can still access the leaked information through the stale cache. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. As a temporary workaround, administrators can restrict summary generation by tightening the allowed groups on the summarization Personas. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32244.

In Twenty CRM versions 1.7.7 through 1.16.7 a critical severity vulnerability CVE-2026-46624 was detected. This vulnerability allows an authenticated user to execute arbitrary OS commands on the database server (Remote Code Execution) if the Postgres user is a superuser. This occurs due to a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack, where the timeZone field within the group_by query parameter in the REST API is directly interpolated into a raw SQL expression without any parameterization, validation, or escaping. There’s no fix available for this issue at the moment.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46624.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3636 was detected. This vulnerability allows a user without elevated permissions to obtain sensitive data regarding team members’ roles. This occurs because the application fails to properly sanitize team member data when it is returned via various team API endpoints. To address this issue, users should upgrade Mattermost to version Version 11.7.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3636.

In Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, and 10.11.x <= 10.11.14 a medium severity vulnerability CVE-2026-3473 was detected. This vulnerability allows an authenticated user to access and download files belonging to other users or teams. This occurs due to improper file ownership validation and access control in the Boards API, where crafted requests using valid file IDs are processed without verifying the requester’s permissions. To address this issue, users should upgrade Mattermost to version 11.7.0 and higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-3473.

In Mattermost Plugins versions <= 11.5, 11.1.5, 10.13.11, and 11.3.4.0 a medium severity vulnerability CVE-2026-6342 was detected. This vulnerability allows plugin users to create subscriptions to groups that were not whitelisted. This occurs because the system fails to appropriately check for valid namespaces, allowing attackers to bypass restrictions by creating groups that share the same prefix as a whitelisted group. There's no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6342.