4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4646

CVE-2026-4646: Insufficient input validation in GitHub plugin API causes denial of service

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows an authenticated attacker to crash the plugin process via a crafted HTTP request to the PR details endpoint.. Mattermost Advisory ID: MMSA-2026-00638

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4646

CVE-2026-4646:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	= 11.6.0	11.6.1
github.com/mattermost/mattermost-server	go	>= 11.5.0, < 11.5.4	11.5.4
github.com/mattermost/mattermost-server	go	>= 11.4.0, < 11.4.5	11.4.5
github.com/mattermost/mattermost-server	go	>= 10.11.0, < 10.11.15	10.11.15
github.com/mattermost/mattermost-plugin-github	go	< 1.0.1-0.20260330164815-c2840e980b3c	1.0.1-0.20260330164815-c2840e980b3c

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by insufficient input validation in several API handlers within the Mattermost GitHub plugin. The primary and most critical flaw exists in the getRepoOwnerAndNameFromURL function. This function would split a URL string by '/' and then access elements [len-2] and [len-1] without first checking if the split resulted in at least two elements. An attacker could provide a malformed URL (e.g., a single word) in a request to the PR details endpoint (/pr/details), which is handled by Plugin.getPrsDetails. This would cause getRepoOwnerAndNameFromURL to receive the malformed URL, leading to an 'index out of range' panic, which in turn crashes the entire plugin process.

The patch addresses this by completely rewriting getRepoOwnerAndNameFromURL to safely parse different GitHub URL formats and return an error if the URL is invalid. The calling functions, Plugin.getPrsDetails and Plugin.fetchPRDetails, were updated to check for this error and handle it gracefully.

A similar, though less critical, validation flaw was found and fixed in the Plugin.createIssue and parseRepo functions, which also performed unsafe string parsing on user-supplied repository names.

Vulnerable functions

Plugin.getPrsDetails

server/plugin/api.go

This is the API handler for the PR details endpoint. It receives the user-supplied input and, prior to the patch, passed it to other functions without sufficient validation, leading to a potential crash.

Plugin.fetchPRDetails

server/plugin/api.go

This function is called by `getPrsDetails` and it directly calls the vulnerable function `getRepoOwnerAndNameFromURL` with user-controlled data (`prURL`). The lack of error handling on the returned values could lead to a crash.

getRepoOwnerAndNameFromURL

server/plugin/api.go

This function is the root cause of the crash. It unsafely splits a URL string and accesses array elements without checking if the split produced enough elements. A crafted URL string could cause `len(splitted)` to be less than 2, leading to a panic from an index out-of-bounds error.

Plugin.createIssue

server/plugin/api.go

Similar to `getPrsDetails`, this API handler for creating issues was vulnerable because it used unsafe string splitting to parse the repository from user input. This could be exploited to cause issues, although the primary vulnerability was the crash in the PR details endpoint.

parseRepo

server/plugin/api.go

This function was vulnerable to incomplete repository strings (e.g., `/repo` or `owner/`). While it might not crash, it could lead to unexpected behavior. The patch fixed this by ensuring both parts of the repository string are non-empty.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.