OpenID Vulnerability in Mattermost Leading to User Account Takeover
CVE-2026-27656

5.7MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
25 March 2026

What is CVE-2026-27656?

Mattermost versions 11.4.0 and lower, including earlier versions of 11.3.x, 11.2.x, and 10.11.x, suffer from an identity validation weakness in the OpenID {{IsSameUser()}} logic. This vulnerability allows attackers to exploit overly permissive substring matching in the user discovery process, potentially leading to unauthorized access to user accounts. Users are encouraged to review the Mattermost security advisory for further details and remediation steps.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Mattermost 11.4.0

Mattermost 11.3.0 <= 11.3.1

Mattermost 11.2.0 <= 11.2.3

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christopher Poile
JSON
.