Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-21388 · ADVISORY
• mattermost/mattermost-plugin-msteams commit 6fe4d29 · WEB
• mattermost/mattermost-plugin-msteams · PACKAGE
• mattermost/mattermost-plugin-msteams release v2.3.2 · WEB
• mattermost.com/security-updates · WEB
• GitHub Advisory GHSA-x274-8qfc-hrgf · ADVISORY

github.com/mattermost/mattermost-plugin-msteams のその他の脆弱性

• CVE-2026-24661中 6.5Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated…
• CVE-2026-2476中 4.3Mattermost Plugins versions <=2.0.3.0 fail to properly mask sensitive configuration values which allows an attacker with access to support p…
• CVE-2025-27936中 5.9Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform co…