CVE-2026-2462CWE-863

Admin RCE via Malicious Plugin Upload on CI Test Instances

Medium · published March 16, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to restrict plugin installation on CI test instances with default admin credentials which allows an unauthenticated attacker to achieve remote code execution and exfiltrate sensitive configuration data including AWS and SMTP credentials via uploading a malicious plugin after changing the import directory. Mattermost Advisory ID: MMSA-2025-00528

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-16T12:00Z
EPSS history
Timeline
  • 16 MAR 12:00Z
    Admin RCE via Malicious Plugin Upload on CI Test Instances
    cvelistv5