GitStock

mattermost/mattermost · Security

Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds

Open GitHub
GHSA ID
GHSA-86vc-mg26-fj6x
CVE ID
CVE-2026-20719
Severity
medium
Published
Updated
CVSS
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v3
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Description

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub. Mattermost Advisory ID: MMSA-2026-00595

CWEs

  • CWE-754 · Improper Check for Unusual or Exceptional Conditions

References