sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2026-96259 Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator

Medium 5.5 Published Updated

A System Administrator can exploit missing internal connection filters in OAuth endpoints to perform server-side request forgery and read internal network responses.

Exploited in the wild
Not known
Login needed
An administrator
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2026-96259?

CVE-2026-96259 is a medium-severity server-side request forgery vulnerability in Mattermost Mattermost Server, published on 22 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal-connection filter to OAuth endpoint requests, which allows a System Administrator to make the server issue requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints.. Mattermost Advisory ID: MMSA-2026-00776

Weakness: CWE-918

Which versions are affected by CVE-2026-96259?

It affects 1 product.

Products include Mattermost Mattermost Server.

How do I fix CVE-2026-96259?

No fix has been published for CVE-2026-96259 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-96259 being exploited?

There is no known exploitation of CVE-2026-96259 in the wild and no public exploit code.

All Mattermost Mattermost Server vulnerabilities

Sources

Also known as GHSA-j85c-qqpv-57m3.

Is CVE-2026-96259 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free