CVE-2026-16049

Name of the Vulnerable Software and Affected Versions Mattermost Plugins versions prior to 11.8 Mattermost Plugins version 10.20.11 Mattermost Plugins version 11.5.7.0

Description The Mattermost GitLab plugin does not verify channel permissions when processing API requests that include a caller-supplied post id. Additionally, it fails to validate the web url parameter against the configured GitLab instance. This allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they are not authorized to access through the 'createIssue' and 'attachCommentToIssue' API endpoints.

Recommendations Update Mattermost Plugins to a version newer than 11.8. Update Mattermost Plugins to a version newer than 10.20.11. Update Mattermost Plugins to a version newer than 11.5.7.0. As a temporary mitigation, restrict access to the 'createIssue' and 'attachCommentToIssue' API endpoints.