| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 11.3.0-rc1+incompatible, < 11.3.3+incompatible≥ 11.4.0-rc1+incompatible, < 11.4.3+incompatible≥ 11.5.0-rc1+incompatible, < 11.5.0+incompatible | 11.3.3+incompatible11.4.3+incompatible11.5.0+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 11.3.0-rc1, < 11.3.3≥ 11.4.0-rc1, < 11.4.3≥ 11.5.0-rc1, < 11.5.0≥ 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260220133927-c29cf05d40f8 | 11.3.311.4.311.5.08.0.0-20260220133927-c29cf05d40f8 |
| mattermost server | ≥ 10.11.0, < 10.11.13≥ 11.3.0, < 11.3.3≥ 11.4.0, < 11.4.3≥ 11.5.0, < 11.5.1 | 10.11.1311.3.311.4.311.5.1 |
Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free