Mattermost server versions 10.11.x <= 10.11.14, 11.4.x <= 11.4.4, 11.5.x <= 11.5.3, and 11.6.0 fail to validate user input in API request handlers. This improper input validation enables an authenticated attacker to cause a denial of service by crashing the plugin process via a specially crafted HTTP request targeting the pull request details endpoint. The issue is tracked as CVE-2026-4646 and is considered a moderate severity vulnerability with a CVSS 3.1 vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and availability impact only.

An authenticated attacker can exploit this vulnerability to crash the plugin process, resulting in denial of service conditions affecting the availability of the Mattermost server's plugin functionality. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Mattermost advisory MMSA-2026-00638 for current remediation guidance. Since no official patch or fix links are provided, users should monitor vendor communications for updates. In the meantime, restricting authenticated user access to trusted parties may reduce risk.