tocsin

CVE-2026-6673

2 advisories.

Go/github.com/mattermost/mattermost-server CVE-2026-6673: medium 6.4, EPSS 0.30%

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret

Action: Upgrade github.com/mattermost/mattermost-server to 10.11.18 or later.

go get github.com/mattermost/mattermost-server@v11.7.1
go get github.com/mattermost/mattermost-server@v11.6.3
go get github.com/mattermost/mattermost-server@v11.5.6
go get github.com/mattermost/mattermost-server@v10.11.18

Affected

introducedfixedlast affected
11.7.011.7.1-
11.6.011.6.3-
11.5.011.5.6-
10.11.010.11.18-

Fixed versions

11.7.111.6.311.5.610.11.18

Sources

CVE-2026-6673 · published · modified · JSON

Go/github.com/mattermost/mattermost-server CVE-2026-6673: unknown, EPSS 0.30%

Mattermost doesn't authenticate Atlassian Connect installed callbacks, allowing a remote unauthenticated attacker to inject a rogue sharedSecret in github.com/mattermost/mattermost-server

Action: Upgrade github.com/mattermost/mattermost-server to 10.11.18+incompatible or later.

go get github.com/mattermost/mattermost-server@v10.11.18+incompatible
go get github.com/mattermost/mattermost-server@v11.5.6+incompatible
go get github.com/mattermost/mattermost-server@v11.6.3+incompatible
go get github.com/mattermost/mattermost-server@v11.7.1+incompatible

Affected

introducedfixedlast affected
10.11.0+incompatible10.11.18+incompatible-
11.5.0+incompatible11.5.6+incompatible-
11.6.0+incompatible11.6.3+incompatible-
11.7.0+incompatible11.7.1+incompatible-

Fixed versions

10.11.18+incompatible11.5.6+incompatible11.6.3+incompatible11.7.1+incompatible

Sources

CVE-2026-6673 · published · modified · JSON