tocsin

Go/github.com/mattermost/mattermost/server/v8 CVE-2026-6339: medium 4.3, EPSS 0.11%

Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint

Action: Upgrade github.com/mattermost/mattermost/server/v8 to 8.0.0-20260327001745-7a339a6438f5 or later.

go get github.com/mattermost/mattermost/server/v8@v11.5.2
go get github.com/mattermost/mattermost/server/v8@v11.4.4
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260327001745-7a339a6438f5

Affected

introducedfixedlast affected
11.5.011.5.2-
11.4.011.4.4-
08.0.0-20260327001745-7a339a6438f5-

Fixed versions

11.5.211.4.48.0.0-20260327001745-7a339a6438f5

Sources

CVE-2026-6339 · published · modified · JSON