Description (CNA)
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Mattermost / Mattermost | affected 11.6.0 through 11.6.0; affected 11.5.0 through 11.5.3; affected 11.4.0 through 11.4.4; affected 10.11.0 through 10.11.14; unaffected 11.7.0; unaffected 11.6.1; unaffected 11.5.4; unaffected 11.4.5; unaffected 10.11.15 |
CWE
CWE-863
References
ADP enrichment
No English description supplied.
No references supplied.