3.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-3495

CVE-2026-3495: Mattermost doesn't escape some variables that could contain malicious content during error page composition

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those values.. Mattermost Advisory ID: MMSA-2026-00622

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-3495

CVE-2026-3495:

3.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260310115442-5a1ea95044d	8.0.0-20260310115442-5a1ea95044d
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260310115442-5a1ea95044dc	5.3.2-0.20260310115442-5a1ea95044dc

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in how Mattermost constructs error pages for mobile authentication flows. The analysis of the patch 5a1ea95044dc2d1ca601bfe9a4c1bc17990f3872 reveals that two functions, utils.RenderMobileAuthComplete and utils.RenderMobileError, were directly embedding variables into HTML without proper sanitization. Specifically, redirectURL, err.Message, and config.TeamSettings.SiteName were not being escaped. This allows an attacker, who can control these values (e.g., by having administrative access to change the site name), to inject arbitrary JavaScript. When a user encounters an error or completes an authentication flow on mobile, these vulnerable functions are called to generate a status page, which would then execute the malicious script in the user's browser. The patch addresses this by introducing HTML escaping for these variables, thus preventing the XSS vulnerability.

Vulnerable functions

utils.RenderMobileAuthComplete

server/channels/utils/api.go

The function `RenderMobileAuthComplete` was vulnerable to XSS because it rendered the `redirectURL` (passed as `link`) into an HTML template without proper escaping. An attacker could craft a malicious `redirectURL` containing JavaScript, which would then be executed in the user's browser. The patch fixes this by using `i18n.TranslateAsHTML`, which ensures the content is safely escaped.

utils.RenderMobileError

server/channels/utils/api.go

The function `RenderMobileError` was vulnerable to XSS because it rendered `err.Message` and `config.TeamSettings.SiteName` directly into an HTML error page without escaping. An attacker with permissions to modify the site configuration could inject malicious JavaScript into the `SiteName`, or trigger an error with a crafted message, leading to code execution in the context of the user's browser. The patch mitigates this by using `template.HTMLEscapeString` for the error message and `i18n.TranslateAsHTML` for the site name.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.