CVE-2026-5139

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17

Description Improper authorization in the GitLab connect command handler allows any authenticated user to overwrite the global default GitLab instance configuration. This occurs because the software fails to enforce administrator authorization on the setDefaultInstance function call when using the '/gitlab connect ' slash command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.