6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4915

CVE-2026-4915: Server panic via outgoing webhook responses

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webhook attachment payloads before processing, which allows an authenticated user to cause a denial of service (server process termination) via a crafted webhook callback response containing a null attachment entry.. Mattermost Advisory ID: MMSA-2026-00641

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4915

CVE-2026-4915:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	= 11.6.0	11.6.1
github.com/mattermost/mattermost-server	go	>= 11.5.0, < 11.5.4	11.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ProcessMessageAttachments function, which is responsible for processing message attachments from incoming webhooks. The provided commit faa7d75b4ea041701e97948f8aa1332e3626a39a clearly shows the fix. In server/channels/app/slack.go, the loop in ProcessMessageAttachments was changed from iterating over the raw attachments slice to iterating over nonNilAttachments, which is a sanitized version of the original slice. The vulnerability description states that the server fails to 'filter nil elements from outgoing webhook attachment payloads'. The original code, for _, attachment := range attachments, would cause a panic if attachments contained a nil value, as it would then attempt a nil pointer dereference on attachment.Pretext. The new test case TestProcessMessageAttachmentsWithNilEntries added in server/channels/app/slack_test.go confirms this exact scenario was the cause of the issue. The change in server/channels/app/webhook.go to add a panic recovery mechanism is a defense-in-depth mitigation, but the root cause of the vulnerability is in ProcessMessageAttachments.

Vulnerable functions

App.ProcessMessageAttachments

server/channels/app/slack.go

The function iterates over a slice of pointers to `model.MessageAttachment`. Before the patch, it did not check for `nil` elements in the slice. If an incoming webhook payload contained a `null` entry in the attachments array, this would result in a `nil` pointer in the slice. When the code attempted to access fields of this `nil` pointer (e.g., `attachment.Pretext`), it caused a nil pointer dereference, leading to a server panic and a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.