CVE-2026-25783
Mattermost Server 10.11.0 – 10.11.11
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-25783 is a medium-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-5 (Denial-of-service Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12416
Vulnerability Data
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate User-Agent header tokens which allows an authenticated attacker to cause a request panic via a specially crafted User-Agent header. Mattermost Advisory ID: MMSA-2026-00586
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Input validation flaw in User-Agent header directly enables authenticated attacker to trigger application panic, mapping to application exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of User-Agent header tokens to reject malformed input before it reaches request-handling code and triggers a panic.
Ensures the application handles invalid header values gracefully instead of allowing a crafted User-Agent to cause an unhandled request panic.
Limits the impact of the resulting denial-of-service condition when an authenticated attacker supplies a malicious User-Agent header.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input type validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-validation flaws but does not prevent them during development.
Secure development lifecycle mandates input validation and type checking to prevent improper type handling.
Application security requirements explicitly include validation of input data types and formats.
Secure architecture principles promote defensive input handling and type enforcement at system boundaries.
Secure coding standards directly require proper type validation of all external inputs.