OpenID Vulnerability in Mattermost Leading to User Account Takeover
CVE-2026-27656

5.7MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
25 March 2026

What is CVE-2026-27656?

Mattermost versions 11.4.0 and lower, including earlier versions of 11.3.x, 11.2.x, and 10.11.x, suffer from an identity validation weakness in the OpenID {{IsSameUser()}} logic. This vulnerability allows attackers to exploit overly permissive substring matching in the user discovery process, potentially leading to unauthorized access to user accounts. Users are encouraged to review the Mattermost security advisory for further details and remediation steps.

Affected Version(s)

Mattermost 11.4.0

Mattermost 11.3.0 <= 11.3.1

Mattermost 11.2.0 <= 11.2.3

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christopher Poile
.