VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 18, 2026· Updated May 18, 2026

CVE-2026-3117

CVE-2026-3117

Description

Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}} or the {{/gitlab webhook {option}}} commands. Mattermost Advisory ID: MMSA-2026-00600

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Mattermost GitLab plugin fails to enforce permissions, allowing normal users to uninstall instances or set up webhooks via commands.

The Mattermost GitLab plugin in versions <=11.5, 11.1.5, 10.13.11, 11.3.4.0 lacks proper permission checks when processing certain commands. Specifically, the {{gitlab instance {option}}} and {{/gitlab webhook {option}}} commands do not verify that the requesting user has administrative privileges, allowing any authenticated user to execute these actions. This vulnerability is identified as MMSA-2026-00600 [1].

To exploit this flaw, an attacker only needs a standard user account on a Mattermost server with the GitLab plugin enabled. The attacker can then send the vulnerable commands through the chat interface without any additional authentication or special network access. The commands are normally restricted to admins, but the missing permission check makes them accessible to all users.

Successful exploitation enables a normal user to uninstall GitLab instances or set up webhook connections. Uninstalling instances can break integrations and cause denial of service, while unauthorized webhooks could be used to exfiltrate data or perform further attacks. The impact is confined to the GitLab plugin but can disrupt Mattermost operations.

Mattermost has released a security advisory for this issue [1]. Users should upgrade to patched versions of the GitLab plugin to mitigate the risk. The fix involves implementing proper authorization checks for the affected commands. Administrators should monitor Mattermost's security updates page for the latest details [1].

References
  1. Security Updates

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

43