CVE-2026-10556 — Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Description (CNA)

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.9.0 through 11.9.0; affected 11.8.0 through 11.8.4; affected 11.7.0 through 11.7.7; affected 10.11.0 through 10.11.22; unaffected 11.10.0; unaffected 11.9.1; unaffected 11.8.5; unaffected 11.7.8; unaffected 10.11.23

CWE

CWE-754

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.