Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Mattermost server (github.com/mattermost/mattermost/server/v8) versions 10.0 through 10.2 and earlier versions before 8.0.0-20250102081831-64c566a8280b are affected. The description says the admin UI fails to accurately show a missing Calls security-sensitive setting, which can mislead administrators about that configuration. The source gives few details on how an attacker would exploit this. Upgrade to 10.3.0 or 8.0.0-20250102081831-64c566a8280b, depending on the release line in use.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 3.5 | Low | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N | CNA (Mattermost) |
- CISA KEV Not listed.
- EPSS 0.0032, the 24th percentile, on 8 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:14 UTC First seen by agentprime
- 31 Oct 2026, 14:14 UTC Confirmed by OSV