CERT-FR relays Mattermost Server advisories MMSA-2026-00592, -00781 and -00786; fixes in 11.7.15, 11.10.5, 11.11.4 and 12.0.2
CERT-FR published advisory CERTFR-2026-AVI-1479 on 6 November 2026 relaying three Mattermost security bulletins dated 5 November 2026 — MMSA-2026-00592, MMSA-2026-00781 and MMSA-2026-00786 — covering multiple vulnerabilities in Mattermost Server. The affected branches are 11.7.x before 11.7.15, 11.10.x before 11.10.5, 11.11.x before 11.11.4 and 12.0.x before 12.0.2. Neither the vendor nor CERT-FR specifies the nature of the flaws, their impact, their severity or any CVE identifier: the advisory states only that an attacker may cause an unspecified security issue. No exploitation in the wild is reported and no indicator of compromise is published. Mattermost's public security-updates page lists its MMSA references without technical detail until a disclosure delay has elapsed, so the operational risk cannot be weighed precisely at this stage.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1479 relays three Mattermost bulletins (MMSA-2026-00592, -00781 and -00786) about multiple vulnerabilities in Mattermost Server. Neither the vendor nor CERT-FR gives the flaw type, the component, the severity, the attacker prerequisites, the impact or any CVE ID. Affected: 11.7.x before 11.7.15, 11.10.x before 11.10.5, 11.11.x before 11.11.4 and 12.0.x before 12.0.2. Fixed in 11.7.15, 11.10.5, 11.11.4 and 12.0.2.
Como foi descoberta
The articles do not say who found the flaws or how. Mattermost published the three bulletins on 5 November 2026 and CERT-FR relayed them on 6 November. According to the story, Mattermost's public security-updates page lists MMSA references without technical detail until a disclosure delay has elapsed. No exploitation in the wild and no indicators of compromise are reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:30.
Remediação
Upgrade Mattermost Server to 11.7.15, 11.10.5, 11.11.4 or 12.0.2 depending on the branch in use, as directed by the vendor bulletins referenced by CERT-FR (cert.cyber.gouv.fr). Self-hosted instances exposed to the internet should be prioritised, and administrators should monitor mattermost.com/security-updates for the detailed MMSA entries once published.
Linha do tempo
-
CERT-FR relays Mattermost Server advisories MMSA-2026-00592, -00781 and -00786; fixes in 11.7.15, 11.10.5, 11.11.4 and 12.0.2
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1479 on 6 November 2026 relaying three Mattermost security bulletins dated 5 November 2026 — MMSA-2026-00592, MMSA-2026-00781 and MMSA-2026-00786 — covering multiple vulnerabilities in Mattermost Server. The affected branches are 11.7.x before 11.7.15, 11.10.x before 11.10.5, 11.11.x before 11.11.4 and 12.0.x before 12.0.2. Neither the vendor nor CERT-FR specifies the nature of the flaws, their impact, their severity or any CVE identifier: the advisory states only that an attacker may cause an unspecified security issue. No exploitation in the wild is reported and no indicator of compromise is published. Mattermost's public security-updates page lists its MMSA references without technical detail until a disclosure delay has elapsed, so the operational risk cannot be weighed precisely at this stage.
Remediation
Upgrade Mattermost Server to 11.7.15, 11.10.5, 11.11.4 or 12.0.2 depending on the branch in use, as directed by the vendor bulletins referenced by CERT-FR (cert.cyber.gouv.fr). Self-hosted instances exposed to the internet should be prioritised, and administrators should monitor mattermost.com/security-updates for the detailed MMSA entries once published.