CVE-2026-6339

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.4.x through 11.4.3 Mattermost versions 11.5.x through 11.5.1

Description An issue exists where the burn-on-read reveal endpoint fails to validate the 'X-Requested-With' header. This allows an authenticated channel member to force the reveal of a burn-on-read message without the recipient's consent by using a crafted Markdown image tag.

Recommendations Update Mattermost versions 11.4.x through 11.4.3 to a version later than 11.4.3. Update Mattermost versions 11.5.x through 11.5.1 to a version later than 11.5.1.