Mattermost · Mattermost Github Plugin · CVE-2026-16049
**Name of the Vulnerable Software and Affected Versions**
Mattermost Plugins versions prior to 11.8
Mattermost Plugins version 10.20.11
Mattermost Plugins version 11.5.7.0
**Description**
The Mattermost GitLab plugin does not verify channel permissions when processing API requests that include a caller-supplied `post id`. Additionally, it fails to validate the `web url` parameter against the configured GitLab instance. This allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they are not authorized to access through the 'createIssue' and 'attachCommentToIssue' API endpoints.
**Recommendations**
Update Mattermost Plugins to a version newer than 11.8.
Update Mattermost Plugins to a version newer than 10.20.11.
Update Mattermost Plugins to a version newer than 11.5.7.0.
As a temporary mitigation, restrict access to the 'createIssue' and 'attachCommentToIssue' API endpoints.