by Kastro
Paper/Archive/CVE-2026-12985

CVE-2026-12985

Mattermost Mattermost — Mattermost DCR redirect URI allowlist bypass via improper URL component validation

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (NVD)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 18.9.189 × 203.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component (matching glob patterns against the raw URI string instead) which allows a remote unauthenticated attacker to register an OAuth client with an attacker-controlled callback host that bypasses the configured redirect URI allowlist via a crafted redirect URI that places an allowlisted host/path suffix inside the query string.. Mattermost Advisory ID: MMSA-2026-00700

Affected

ProductAffectedFixed inSource
Mattermost11.9.0 – 11.9.011.10.0CNA
Mattermost11.8.0 – 11.8.411.10.0CNA
Mattermost11.7.0 – 11.7.711.10.0CNA

Scores by source

NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Mattermost (CNA)6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymattermost.com/security-updates