CVE-2026-0999

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0999", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "state": "PUBLISHED", "assignerShortName": "Mattermost", "dateReserved": "2026-01-15T15:59:41.357Z", "datePublished": "2026-02-16T09:47:45.960Z", "dateUpdated": "2026-02-17T16:53:07.181Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "11.1.2", "status": "affected", "version": "11.1.0", "versionType": "semver"}, {"lessThanOrEqual": "10.11.9", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"lessThanOrEqual": "11.2.1", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"version": "11.3.0", "status": "unaffected"}, {"version": "11.1.3", "status": "unaffected"}, {"version": "10.11.10", "status": "unaffected"}, {"version": "11.2.2", "status": "unaffected"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daw10"}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548"}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseSeverity": "MEDIUM", "baseScore": 5.4}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm", "cweId": "CWE-303"}]}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2025-00548", "tags": ["vendor-advisory"]}], "solutions": [{"value": "Update Mattermost to versions 11.3.0, 11.1.3, 10.11.10, 11.2.2 or higher.", "lang": "en"}], "source": {"advisory": "MMSA-2025-00548", "defect": ["https://mattermost.atlassian.net/browse/MM-66415"], "discovery": "EXTERNAL"}, "title": "Authentication bypass via userID login when email and username login are disabled", "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-02-16T09:47:45.960Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:52:58.796354Z", "id": "CVE-2026-0999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:53:07.181Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:52:58.796354Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:53:03.665Z"}}], "cna": {"title": "Authentication bypass via userID login when email and username login are disabled", "source": {"defect": ["https://mattermost.atlassian.net/browse/MM-66415"], "advisory": "MMSA-2025-00548", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "daw10"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.1.0", "versionType": "semver", "lessThanOrEqual": "11.1.2"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.9"}, {"status": "affected", "version": "11.2.0", "versionType": "semver", "lessThanOrEqual": "11.2.1"}, {"status": "unaffected", "version": "11.3.0"}, {"status": "unaffected", "version": "11.1.3"}, {"status": "unaffected", "version": "10.11.10"}, {"status": "unaffected", "version": "11.2.2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Mattermost to versions 11.3.0, 11.1.3, 10.11.10, 11.2.2 or higher."}], "references": [{"url": "https://mattermost.com/security-updates", "name": "MMSA-2025-00548", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-303", "description": "CWE-303: Incorrect Implementation of Authentication Algorithm"}]}], "providerMetadata": {"orgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "shortName": "Mattermost", "dateUpdated": "2026-02-16T09:47:45.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0999", "state": "PUBLISHED", "dateUpdated": "2026-02-17T16:53:07.181Z", "dateReserved": "2026-01-15T15:59:41.357Z", "assignerOrgId": "9302f53e-dde5-4bf3-b2f2-a83f91ac0eee", "datePublished": "2026-02-16T09:47:45.960Z", "assignerShortName": "Mattermost"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mattermost", "vendor": "Mattermost", "versions": [{"lessThanOrEqual": "11.1.2", "status": "affected", "version": "11.1.0", "versionType": "semver"}, {"lessThanOrEqual": "10.11.9", "status": "affected", "version": "10.11.0", "versionType": "semver"}, {"lessThanOrEqual": "11.2.1", "status": "affected", "version": "11.2.0", "versionType": "semver"}, {"status": "unaffected", "version": "11.3.0"}, {"status": "unaffected", "version": "11.1.3"}, {"status": "unaffected", "version": "10.11.10"}, {"status": "unaffected", "version": "11.2.2"}]}], "source": "responsibledisclosure@mattermost.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "92B0F8BD-06A1-4B39-95C5-4FB5A195F1C4", "versionEndExcluding": "10.11.10", "versionStartIncluding": "10.11.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F28AD5DC-E336-4DD3-BC31-AC924190433C", "versionEndExcluding": "11.1.3", "versionStartIncluding": "11.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D98EAFB2-8055-4893-835B-30A99ED97892", "versionEndExcluding": "11.2.2", "versionStartIncluding": "11.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to properly validate login method restrictions which allows an authenticated user to bypass SSO-only login requirements via userID-based authentication. Mattermost Advisory ID: MMSA-2025-00548"}, {"lang": "es", "value": "Las versiones de Mattermost 11.1.x &lt;= 11.1.2, 10.11.x &lt;= 10.11.9, 11.2.x &lt;= 11.2.1 no validan correctamente las restricciones del m\u00e9todo de inicio de sesi\u00f3n, lo que permite a un usuario autenticado eludir los requisitos de inicio de sesi\u00f3n solo por SSO mediante autenticaci\u00f3n basada en ID de usuario. ID de aviso de Mattermost: MMSA-2025-00548"}], "id": "CVE-2026-0999", "lastModified": "2026-06-17T10:11:44.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0999", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:52:58.796354Z", "version": "2.0.3"}}]}, "published": "2026-02-16T10:16:08.140", "references": [{"source": "responsibledisclosure@mattermost.com", "tags": ["Vendor Advisory"], "url": "https://mattermost.com/security-updates"}], "sourceIdentifier": "responsibledisclosure@mattermost.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-303"}], "source": "responsibledisclosure@mattermost.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.1.0,11.1.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.11.0,10.11.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.2.0,11.2.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.3.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.1.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "10.11.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "11.2.2"}}], "product": "mattermost", "vendor": "mattermost"}], "analysis": {"en": {"generated_at": "2026-04-17T19:10:29.067117+00:00", "value": {"mitigation_remediation": ["Update Mattermost to version 11.3.0, 11.1.3, 10.11.10, 11.2.2 or higher.", "Confirm that SSO\u2011only authentication restrictions are active in the Mattermost configuration and disable userID login where possible.", "Require multifactor authentication for all user accounts to limit the impact of an authenticated user who bypasses SSO."], "summary": {"action": "Apply Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts Mattermost server deployments running any of the following: version 10.11.0 up to 10.11.9, 11.1.0 up to 11.1.2, or 11.2.0 up to 11.2.1. Users of older or newer minor releases are not affected.", "description_and_impact": "Mattermost versions 10.11.x through 10.11.9, 11.1.x through 11.1.2, and 11.2.x through 11.2.1 fail to properly validate login method restrictions. This allows an authenticated user to bypass the SSO\u2011only login requirement via a userID\u2011based authentication attempt. The resulting privilege escalation grants the attacker unauthorized access that would normally be prevented by single sign\u2011on enforcement, constituting an authentication bypass flaw based on CWE\u2011303.", "risk_and_exploitability": "The CVSS v3.1 score is 5.4, reflecting medium impact. EPSS indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA\u2019s KEV catalog. The likely attack vector requires an attacker to possess valid user credentials; after authentication, they can choose a userID login instead of the enforced SSO path, bypassing the restriction. The risk is moderate, with limited scope to the authenticated context but significant because it removes the guardrail provided by SSO."}}}}, "created": "2026-02-16T12:00:59.330081+00:00", "updated": "2026-04-17T19:15:26.256008+00:00", "vendors": ["mattermost", "mattermost$PRODUCT$mattermost"]}