CVE-2026-6046mediumCWE-200

Plugin bot username conflict allows user account to be used as bot identity in Mattermost Server

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%

probabilidad de explotación

0.2%top 91% de las CVE

explotación observada

noninguna fuente lo reporta

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account, which allows an unprivileged attacker to intercept private messages sent by plugins via direct message channels by pre-registering a user account with a predictable plugin bot username.. Mattermost Advisory ID: MMSA-2026-00649

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Productos afectados

Mattermost · Mattermost

Referencias

https://mattermost.com/security-updates