Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2026-20719

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID: MMSA-2026-00595

VectorNETWORK

PublishedMar 25, 2026, 17:16

Published Byresponsibledisclosure@mattermost.com

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/mattermost/mattermost/server/v8(Go)11.4.0-rc111.4.1N/A

github.com/mattermost/mattermost/server/v8(Go)11.3.0-rc111.3.2N/A

github.com/mattermost/mattermost/server/v8(Go)11.2.0-rc111.2.4N/A

github.com/mattermost/mattermost/server/v8(Go)8.0.0-20260105080200-d27a2195068d8.0.0-20260217110922-b7d4a1f1f59bN/A

github.com/mattermost/mattermost/server/v8(Go)10.11.0-rc110.11.2N/A

References

https://mattermost.com/security-updates

Weakness Type

CWE-754

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK