CVE-2026-20719

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-754

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.4.0, <= 11.4.0; >= 11.3.0, <= 11.3.1; >= 11.2.0, <= 11.2.3; >= 10.11.0, <= 10.11.11

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Mar 25, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-20726.1Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This CVE-2026-207267.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker co CVE-2026-207278.6Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Un CVE-2026-207286.7Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may a CVE-2026-20739.8A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/ind CVE-2026-207303.3A vulnerability exists in BIG-IP Edge Client and browser VPN clients on Windows that may allow attackers to gain access to sensitive informa CVE-2026-207316.1Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Un CVE-2026-207324.3A vulnerability exists in an undisclosed BIG-IP Configuration utility page that may allow an attacker to spoof error messages. Note: Softwa CVE-2026-207335.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-207345.6Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(R) Standard Manageabi CVE-2026-207367.5Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository ma CVE-2026-207377.9Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device