4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-6339

CVE-2026-6339: Missing request origin validation on burn-on-read reveal endpoint

Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-6339

CVE-2026-6339:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260327001745-7a339a6438f5	8.0.0-20260327001745-7a339a6438f5
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260327001745-7a339a6438f5	5.3.2-0.20260327001745-7a339a6438f5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit 7a339a6438f5a4a5feba6b8de887f17a1378b207 clearly indicates that the vulnerability lies within the revealPost function located in server/channels/api4/post.go. The patch introduces a security check at the beginning of this function. Specifically, it verifies the presence of the X-Requested-With header for any request that is authenticated using a session cookie (i.e., when an Authorization header is not present). The absence of this check in vulnerable versions allowed a form of Cross-Site Request Forgery (CSRF) where a malicious actor could force a user's browser to make a request to the reveal endpoint, for example, by embedding a markdown image in a post. This would cause the 'burn-on-read' message to be revealed without the recipient's consent. The identified function, revealPost, is the direct entry point for this action and is where the missing validation occurred.

Vulnerable functions

revealPost

server/channels/api4/post.go

The `revealPost` function is responsible for revealing the content of 'burn-on-read' posts. The vulnerability lies in the fact that, prior to the patch, this function did not validate the `X-Requested-With` header for requests authenticated via session cookies. This allowed an attacker to craft a special markdown image that would trigger a GET request to the reveal endpoint in the victim's browser, causing the message to be revealed without any user interaction. The patch mitigates this by adding a check to ensure that any cookie-authenticated request to this endpoint also contains the `X-Requested-With: XMLHttpRequest` header, thus preventing the attack which relies on simple cross-origin image loading.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.