Code Execution Risk in Mattermost Agents Plugin Affects Multiple Versions

CVE-2026-93851

What is CVE-2026-93851?

The Mattermost Agents plugin exhibits a vulnerability where certain versions fail to properly validate the target post ID in the mention reminder component. This flaw enables an authenticated user, who has channel access visible to a system administrator, to exploit the system. By crafting a malicious post with a forged mention reminder, the user can trick the administrator's browser into sending an unintended API request. This can lead to the replacement of an installed plugin and unauthorized code execution on the server. It is essential for users and administrators to upgrade to secured versions to mitigate the risks associated with this vulnerability.

References