Multiple vulnerabilities in Mattermost products (May 29, 2026)

unknownCVE-2026-4339 CVE-2026-3472

Multiple vulnerabilities have been discovered in Mattermost products. They allow an attacker to cause data confidentiality breach, security policy bypass and an unspecified security issue by the editor.

CSIRTS triage

vendor: Mattermost product: Mattermost Information disclosure Authentication bypass

What: Multiple vulnerabilities in Mattermost products allow attackers to breach data confidentiality and bypass security policies through the editor.
Who is affected: All Mattermost product deployments are affected; specific versions are not stated.
Urgency: Moderate urgency; data confidentiality and policy bypass are serious but no active exploitation reported.
Action: Check Mattermost security advisory page for affected versions and apply available patches.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Mattermost

Get an email when a new Mattermost advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-05-29
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0660/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-43390.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-34720.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-4339	coverage & exploitation status	NVD · CVE.org
CVE-2026-3472	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Mattermost products

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownMultiple vulnerabilities in Mattermost products (August 14, 2026)cert-fr-avis · 2026-08-14
unknownMultiple vulnerabilities in Mattermost products (June 15, 2026)cert-fr-avis · 2026-06-15
unknownMultiple vulnerabilities in Mattermost products (May 22, 2026)cert-fr-avis · 2026-05-22
unknownMultiple vulnerabilities in Mattermost products (May 19, 2026)cert-fr-avis · 2026-05-19