CVE-2026-5139: GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect <instance-name>}} slash command.. Mattermost Advisory ID: MMSA-2026-00644
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.3 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.6 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.18
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5139?
CVE-2026-5139 has a medium severity rating of 5.4.
How do I fix CVE-2026-5139?
To fix CVE-2026-5139, update Mattermost to versions greater than 11.7.0, 11.6.2, 11.5.5, or 10.11.17.
What versions of Mattermost are affected by CVE-2026-5139?
Mattermost versions 11.7.x up to 11.7.0, 11.6.x up to 11.6.2, 11.5.x up to 11.5.5, and 10.11.x up to 10.11.17 are affected by CVE-2026-5139.
What type of users are impacted by CVE-2026-5139?
CVE-2026-5139 affects all authenticated users who can access the GitLab Plugin without admin privileges.
What is the risk associated with CVE-2026-5139?
CVE-2026-5139 poses a risk level of 34, indicating potential unauthorized modification of the default GitLab instance configuration.