Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests… (CVE-2026-16049)
The Mattermost GitLab plugin in certain versions fails to verify channel permissions and validate URLs when processing API requests. This flaw allows an authenticated attacker to inject bot-authored messages with arbitrary URLs into channels they do not have access to. The vulnerability affects API endpoints related to issue creation and comment attachment. It has a CVSS score of 4.3, indicating medium severity.
AI Analysis
Technical Summary
CVE-2026-16049 describes a vulnerability in the Mattermost GitLab plugin where it does not properly verify channel permissions when handling API requests containing a caller-supplied post_id. Additionally, it fails to validate the web_url parameter against the configured GitLab instance. This combination allows an authenticated attacker to inject messages authored by bots containing arbitrary URLs into unauthorized channels via the createIssue and attachCommentToIssue API endpoints. The issue is categorized under CWE-862 (Missing Authorization).
Potential Impact
An authenticated attacker with limited privileges can inject bot-authored messages containing arbitrary URLs into Mattermost channels they are not authorized to access. This could lead to information disclosure or social engineering risks but does not directly impact data integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost advisory MMSA-2026-00673 for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints and monitor usage for suspicious activity.
Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests… (CVE-2026-16049)
Description
The Mattermost GitLab plugin in certain versions fails to verify channel permissions and validate URLs when processing API requests. This flaw allows an authenticated attacker to inject bot-authored messages with arbitrary URLs into channels they do not have access to. The vulnerability affects API endpoints related to issue creation and comment attachment. It has a CVSS score of 4.3, indicating medium severity.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16049 describes a vulnerability in the Mattermost GitLab plugin where it does not properly verify channel permissions when handling API requests containing a caller-supplied post_id. Additionally, it fails to validate the web_url parameter against the configured GitLab instance. This combination allows an authenticated attacker to inject messages authored by bots containing arbitrary URLs into unauthorized channels via the createIssue and attachCommentToIssue API endpoints. The issue is categorized under CWE-862 (Missing Authorization).
Potential Impact
An authenticated attacker with limited privileges can inject bot-authored messages containing arbitrary URLs into Mattermost channels they are not authorized to access. This could lead to information disclosure or social engineering risks but does not directly impact data integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost advisory MMSA-2026-00673 for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints and monitor usage for suspicious activity.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vr3j-2q9w-h26r
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16049"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a833342bf8831d5392a3a75
Added to database: 08/17/2026, 16:13:54 UTC
Last enriched: 08/17/2026, 16:14:48 UTC
Last updated: 08/17/2026, 19:21:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.