CVE-2026-3495 Overview
CVE-2026-3495 is a stored cross-site scripting (XSS) vulnerability in Mattermost Server. The flaw affects Mattermost versions 11.5.x through 11.5.1 and 10.11.x through 10.11.13. The server fails to escape variables that may contain malicious content during error page composition. An attacker with privileges to edit site configuration can inject JavaScript that executes in the browser of users who encounter affected error pages. Mattermost tracks this issue as advisory MMSA-2026-00622 and classifies it under CWE-79.
Critical Impact
Authenticated administrators can inject JavaScript into error pages, leading to script execution in victim browsers, session compromise, and unauthorized actions within the Mattermost workspace.
Affected Products
- Mattermost Server 11.5.0 through 11.5.1
- Mattermost Server 10.11.0 through 10.11.13
- Self-hosted Mattermost deployments using these versions
Discovery Timeline
- 2026-05-18 - CVE-2026-3495 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-3495
Vulnerability Analysis
The vulnerability stems from improper output encoding during error page rendering in Mattermost Server. When the application composes error pages, it injects configuration-derived values into HTML without escaping HTML control characters. An attacker who already holds elevated privileges to modify site configuration can store JavaScript payloads inside affected configuration fields. When any user later triggers an error condition that renders those values, the browser parses the payload as executable script.
The issue is classified as CWE-79, Improper Neutralization of Input During Web Page Generation. Successful exploitation requires user interaction, because a victim must load the affected error page. The scope is changed because the injected script executes in the security context of authenticated Mattermost users distinct from the attacker.
Root Cause
The server-side template responsible for error page composition concatenates configuration strings directly into HTML output. Mattermost did not apply HTML entity encoding to those interpolated variables. Any value containing <script> tags or event handler attributes is rendered verbatim by the browser.
Attack Vector
Exploitation requires a network-accessible Mattermost instance and an authenticated account with high privileges to edit site configuration. The attacker stores a JavaScript payload in a configuration field that flows into error page rendering. When a legitimate user triggers an error, the payload executes in that user's session. The attacker can hijack session tokens, perform actions on behalf of the victim, or pivot to deliver further client-side attacks. No verified public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-3495
Indicators of Compromise
- Configuration audit log entries showing changes to site configuration fields by administrative accounts that contain HTML or JavaScript syntax such as <script>, onerror=, or onload=.
- Unexpected outbound HTTP requests from user browsers loading Mattermost error pages to attacker-controlled domains.
- Anomalous session activity from accounts that recently interacted with Mattermost error pages, including unexpected API calls.
Detection Strategies
- Review the Mattermost config.json and database-backed configuration for fields that contain unescaped HTML markup or scripting syntax.
- Inspect web server access logs for repeated requests to error endpoints following recent configuration changes by privileged users.
- Correlate administrative configuration changes with subsequent error page views to identify suspicious sequences.
Monitoring Recommendations
- Enable verbose audit logging in Mattermost for all configuration changes and forward logs to a centralized SIEM.
- Alert on any modification to site-level configuration outside approved change windows.
- Monitor browser-reported Content Security Policy (CSP) violations originating from Mattermost domains to detect attempted script execution.
How to Mitigate CVE-2026-3495
Immediate Actions Required
- Upgrade Mattermost Server to a fixed release published after the 11.5.1 and 10.11.13 affected ranges, as documented on the Mattermost Security Updates page.
- Audit all System Administrator and configuration-editing accounts and revoke privileges that are not strictly required.
- Review site configuration values for any unexpected HTML or JavaScript content and restore known-good values.
Patch Information
Mattermost addressed CVE-2026-3495 in versions released after 11.5.1 and 10.11.13. Refer to the vendor advisory MMSA-2026-00622 and the Mattermost Security Updates bulletin for exact fixed version numbers and upgrade procedures. The patch applies HTML escaping to variables interpolated into error page templates.
Workarounds
- Restrict the manage_system and equivalent permissions to a minimal set of trusted administrators until patching is complete.
- Enforce a strict Content Security Policy header on the Mattermost reverse proxy to block inline script execution as a defense-in-depth measure.
- Require multi-factor authentication for all accounts with configuration edit capabilities to reduce the risk of account takeover leading to exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
