← CVE Intelligence

CVE-2026-86348

MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process PUBLISHED

Description (CNA)

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701

Affected (CNA)

Vendor / productVersions
Mattermost / Mattermostaffected <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 through <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0; unaffected 11.10.0; unaffected 11.9.1; unaffected 11.8.5; unaffected 11.7.8; unaffected 10.11.23

CWE

CWE-704

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.