GitHub Advisoryadvisory · Go

GHSA-r5vf-grcx-5vqp Mattermost allows authenticated users to gain access to private repositories

MEDIUM Published 2026-05-26 Modified 2026-06-29 Official page ↗
Aliases
CVE-2026-28735
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-plugin-github
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-863
Reviewed
2026-06-29

Affected packages

• Go github.com/mattermost/mattermost-server: >= 11.6.0, < 11.6.1 → fixed in 11.6.1 • Go github.com/mattermost/mattermost-server: >= 11.5.0, < 11.5.4 → fixed in 11.5.4 • Go github.com/mattermost/mattermost-server: >= 11.4.0, < 11.4.5 → fixed in 11.4.5 • Go github.com/mattermost/mattermost-server: >= 10.11.0, < 10.11.15 → fixed in 10.11.15 • Go github.com/mattermost/mattermost-plugin-github: < 1.0.1-0.20260318132218-6e6b740c4852 → fixed in 1.0.1-0.20260318132218-6e6b740c4852

Description

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL. Mattermost Advisory ID: MMSA-2026-00628

Related

Alias · CVE (1)

  • CVE-2026-28735 Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References