Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an… (CVE-2026-10080)
Mattermost versions 11.7.x up to 11.7.6, 10.11.x up to 10.11.21, and 11.8.x up to 11.8.3 contain a vulnerability where WebSocket command field types are not properly validated. This flaw allows an authenticated user to crash the plugin process and cause a denial of service for all Boards users by sending a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.
AI Analysis
Technical Summary
The vulnerability in Mattermost affects versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3. It arises from improper validation of WebSocket command field types, specifically allowing an authenticated user to send a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId. This triggers a crash in the plugin process, resulting in denial of service for all users of the Boards feature. The issue is tracked as CVE-2026-10080 and is classified under CWE-704 (Incorrect Type Conversion or Cast). The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacting availability only.
Potential Impact
An authenticated user can exploit this vulnerability to crash the plugin process responsible for Boards functionality, causing a denial of service to all Boards users. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost vendor advisory MMSA-2026-00687 for current remediation guidance. Until an official fix is available, restrict access to authenticated users who can send WebSocket commands and monitor for unusual plugin crashes related to Boards usage.
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate WebSocket command field types which allows an… (CVE-2026-10080)
Description
Mattermost versions 11.7.x up to 11.7.6, 10.11.x up to 10.11.21, and 11.8.x up to 11.8.3 contain a vulnerability where WebSocket command field types are not properly validated. This flaw allows an authenticated user to crash the plugin process and cause a denial of service for all Boards users by sending a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.
CVSS v3.1
Score 6.5medium
Affected software
pkg:github/mattermost/mattermost-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Mattermost affects versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3. It arises from improper validation of WebSocket command field types, specifically allowing an authenticated user to send a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId. This triggers a crash in the plugin process, resulting in denial of service for all users of the Boards feature. The issue is tracked as CVE-2026-10080 and is classified under CWE-704 (Incorrect Type Conversion or Cast). The CVSS 3.1 score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, and impacting availability only.
Potential Impact
An authenticated user can exploit this vulnerability to crash the plugin process responsible for Boards functionality, causing a denial of service to all Boards users. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the Mattermost vendor advisory MMSA-2026-00687 for current remediation guidance. Until an official fix is available, restrict access to authenticated users who can send WebSocket commands and monitor for unusual plugin crashes related to Boards usage.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-523x-7gmh-rhpc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-10080"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a83aa74bf8831d539e31eda
Added to database: 08/18/2026, 00:42:28 UTC
Last enriched: 08/18/2026, 01:11:57 UTC
Last updated: 08/18/2026, 01:53:16 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.