CVE-2026-4646
Mattermost Server 10.11.0 – 10.11.15
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2026-4646 is a medium-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability in Mattermost Mattermost Server. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-31430
Vulnerability Data
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the…
more
PR details endpoint.. Mattermost Advisory ID: MMSA-2026-00638
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Input validation failure in API handler directly enables authenticated DoS via crafted request causing plugin process crash (T1499.004 Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied input in API handlers, preventing the crafted request that crashes the plugin process.
Requires proper error handling for invalid inputs so that malformed PR-details requests do not cause the plugin process to crash.
Boundary-protection mechanisms can enforce additional checks or filtering on API endpoints before unvalidated input reaches the plugin handler.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input type validation during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-validation flaws but does not prevent them during development.
Secure development lifecycle mandates input validation and type checking to prevent improper type handling.
Application security requirements explicitly include validation of input data types and formats.
Secure architecture principles promote defensive input handling and type enforcement at system boundaries.
Secure coding standards directly require proper type validation of all external inputs.