CVE-2026-28741
Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-2026-00625
- Affected products
- Mattermost
- Mattermost Mattermost Server
- < 10.11.13, 11.3.3, 11.4.3, 11.5.1
- CVSS 3.1
- 8.1 HIGH
- EPSS
- 0.1% (3th percentile)
- Weakness
- CWE-352
- NVD status
- Analyzed
- Published
- 2026-04-15
Fix
Update Mattermost to versions 10.11.13, 11.5.1, 11.4.3, 11.3.3 or higher.
CVE-2026-28741 at NVD
No indexed exploits for CVE-2026-28741 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-28741 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.