VulnSocial

CVE-2026-3116Disclosure(mattermost / mattermost_server)

LOWCVSS 4.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Mattermost Plugins versions <=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause service disruption via the webhook endpoint. Mattermost Advisory ID: MMSA-2026-00589

mattermost CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mattermost_server

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 3 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-28)
  • 3 total mentions across 2 days

Affected systems

Vendors
mattermost
Products
mattermost_server

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-26: 1Mentions · 2026-03-28: 2Technical Details · 2026-03-28: 203-2603-28
Signal classification1 categories
Disclosure
3100.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-261
Disclosure1
2026-03-282
Disclosure2
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-3116 Mattermost Plugins versions &lt;=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause service disrup… https://www.cve.org/CVERecord?id=CVE-2026-3116

    Post summary

    CVE‑2026‑3116 reports a request size validation flaw in Mattermost Plugins that lets authenticated attackers cause service disruption; no PoC, exploit code, active exploitation, or patch details are provided.

    00010253
    56.9K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-3116 Mattermost Plugins versions &lt;=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0 fail to validate incoming request size which allows an authenticated attacker to cause service disrup… https://www.cve.org/CVERecord?id=CVE-2026-3116 ----- Traducción: CVE-2026-3116 Plu… http://infoflow.cloud`

    Post summary

    It announces CVE-2026-3116 in Mattermost plugins, pointing out that inadequate request size validation can let authenticated users trigger a denial‑of‑service. No PoC, exploit, or patch information is provided.

    0000026
    65 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-3116 Mattermost Plugins versions &lt;=11.4 11.0.4 11.1.3 11.3.2 10.11.11.0... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3116 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4

    Post summary

    The tweet announces CVE‑2026-3116 with a list of vulnerable Mattermost plugin versions and links to external details, but provides no PoC, exploit code, or patch information.

    0000051
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmattermostmattermost_server---

Explore more

Back to dashboardmattermost CVEsmattermost_server vulnerabilities