CVE-2026-16049: _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied {{postid}}, and fails to validate the {{weburl}} parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the {{createIssue}} and {{attachCommentToIssue}} API endpoints. Mattermost Advisory ID: MMSA-2026-00673
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost GitLab plugin (Mattermost Plugins)to a version that resolves this vulnerability.Fixed in 11.9.0 - Upgrade
Upgrade
Mattermost GitLab plugin (Mattermost Plugins)to a version that resolves this vulnerability.Fixed in 10.11.21 - Upgrade
Upgrade
Mattermost GitLab plugin (Mattermost Plugins)to a version that resolves this vulnerability.Fixed in 11.7.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16049?
The severity of CVE-2026-16049 is classified as low with a score of 3.9.
How do I fix CVE-2026-16049?
To fix CVE-2026-16049, upgrade to Mattermost Plugins version 11.8 or later.
What types of attacks are possible due to CVE-2026-16049?
CVE-2026-16049 allows for cross-channel post injection and phishing attacks via missing permission checks.
Which versions of Mattermost Plugins are affected by CVE-2026-16049?
Mattermost Plugins versions 11.8, 10.20.11, and 11.5.7.0 are affected by CVE-2026-16049.
What components are involved in the CVE-2026-16049 vulnerability?
CVE-2026-16049 involves the issue API endpoints of the Mattermost GitLab plugin.