CVE-2026-96259

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.10 Mattermost versions 11.8.0 through 11.8.5 Mattermost versions 11.9.0 through 11.9.1 Mattermost versions 11.10.0 through 11.10.1

Description The software fails to apply the internal-connection filter to OAuth endpoint requests. This allows a System Administrator to force the server to issue requests to internal network addresses and read the responses through the configured OAuth token and userinfo endpoints.

Recommendations Update Mattermost versions 11.7.0 through 11.7.10 to a version newer than 11.7.10. Update Mattermost versions 11.8.0 through 11.8.5 to a version newer than 11.8.5. Update Mattermost versions 11.9.0 through 11.9.1 to a version newer than 11.9.1. Update Mattermost versions 11.10.0 through 11.10.1 to a version newer than 11.10.1.