Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🔐 Mattermost CVE-2026-4858: Path Traversal to Admin API Takeover (CVSS 9.9) 🔗 https://threataft.com/articles/mattermost-cve-2026-4858-path-traversal-api-takeover #CyberSecurity #ThreatIntel #Mattermost #CVE20264858
Post summary
The tweet announces the Mattermost CVE‑2026‑4858 vulnerability—path traversal that allows admin API takeover—with a CVSS score of 9.9 and links to a threat‑intelligence article for additional details.
CVE-2026-4858 Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious… https://www.cve.org/CVERecord?id=CVE-2026-4858
Post summary
CVE-2026-4858 affects various Mattermost versions by allowing path traversal in integration URLs; the snippet lists affected releases but provides no PoC, exploit, patch, or evidence of active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | mattermost_server | - | - | - |
| App | mattermost | mattermost_server | 11.6.0 | - | - |