CVE-2026-4646: Insufficient input validation in GitHub plugin API causes denial of service
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.. Mattermost Advisory ID: MMSA-2026-00638
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.4 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.4.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.15 - Compensating control
Until Mattermost is upgraded, mitigate exposure to the GitHub plugin PR details endpoint by restricting/authenticating access so only trusted clients/users can send requests to that endpoint.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4646?
The severity of CVE-2026-4646 is medium with a score of 4.3.
What is CVE-2026-4646?
CVE-2026-4646 is a vulnerability in Mattermost that allows authenticated attackers to crash the plugin process due to insufficient input validation.
How do I fix CVE-2026-4646?
To fix CVE-2026-4646, update Mattermost to versions 11.7.0, 11.6.1, 11.5.4, 11.4.5, 10.11.15 or higher.
What versions of Mattermost are affected by CVE-2026-4646?
Mattermost versions 11.6.x up to 11.6.0, 11.5.x up to 11.5.3, 11.4.x up to 11.4.4, and 10.11.x up to 10.11.14 are affected by CVE-2026-4646.
What type of attack is enabled by CVE-2026-4646?
CVE-2026-4646 enables a denial of service attack via crafted HTTP requests to the PR details endpoint.