Improper Authorization in Mattermost Allows Unauthorized Configuration Changes

CVE-2026-5139

What is CVE-2026-5139?

Mattermost versions 11.7.x prior to 11.7.0, 11.6.x prior to 11.6.2, 11.5.x prior to 11.5.5, and 10.11.x prior to 10.11.17 possess a vulnerability that fails to enforce proper administrator authorization within the {{setDefaultInstance}} call of the {{/gitlab connect}} command handler. This oversight permits any authenticated user to alter the global default GitLab instance configuration simply by utilizing the {{/gitlab connect }} slash command, potentially compromising system integrity. For more information, refer to the Mattermost security advisory.

References