Insufficient Input Validation in Mattermost Leads to Plugin Vulnerability
CVE-2026-116516

6.5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116516?

The Mattermost platform, in versions up to and including 11.10.7.0, exhibits a flaw where it fails to properly validate the length of Zoom chat lines before processing them. This vulnerability can be exploited by an authenticated attacker who manipulates Zoom chat transcription submissions to include excessively short continuation lines. As a result, this action can force the Agents plugin to crash, disrupting services. For further details, refer to the official advisory MMSA-2026-00723.

Affected Version(s)

Mattermost <=11.9 11.1.9 11.5.8 11.10.7.0 <= 11.9 11.1.9 11.5.8 11.10.7.0

Mattermost 11.10.0

Mattermost 11.9.2

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alimursaliyev
.