CVE-2026-5139

MediumCVSS 5.4/10Last modified Jun 23, 2026

Description

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultInstance}} call within the {{/gitlab connect}} command handler, which allows any authenticated user to overwrite the global default GitLab instance configuration via the {{/gitlab connect <instance-name>}} slash command.. Mattermost Advisory ID: MMSA-2026-00644

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
MattermostMattermost>= 11.7.0, <= 11.7.0; >= 11.6.0, <= 11.6.2; >= 11.5.0, <= 11.5.5; >= 10.11.0, <= 10.11.17

References

Timeline

Published
Jun 22, 2026
Last modified
Jun 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-51408.8Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute PardusCVE-2026-514008.4An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within fiCVE-2026-514017.7An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within fiCVE-2026-51418.8Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software TechnologiesCVE-2026-51426.5A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download privCVE-2026-51448.8The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is dueCVE-2026-51464.3Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or deletCVE-2026-51477.3A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/gCVE-2026-51484.7A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/maCVE-2026-51496.5The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_CVE-2026-51507.3A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /vCVE-2026-51528.8A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performi