CVE-2026-10556: Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.8 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.23
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Mattermost instances running the Microsoft Calendar plugin are exposed if they use Mattermost 11.9.0 or earlier in the 11.9.x line, 11.8.4 or earlier in 11.8.x, 11.7.7 or earlier in 11.7.x, or 10.11.22 or earlier in 10.11.x. The impact is loss of calendar integration service for all users on the affected instance.
Does an attacker need an account or prior access to exploit it?
No. An unauthenticated attacker can send a crafted POST request to the public Microsoft Graph webhook endpoint; no privileges or user interaction are required.
What condition triggers the plugin crash?
The vulnerable plugin does not validate null entries in Microsoft Graph webhook notification payloads. A crafted notification payload containing a null entry can crash the Microsoft Calendar plugin process.