CVE-2026-27659CWE-352

CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint

Medium · published March 25, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-03-25T16:33Z
EPSS history
Timeline
  • 25 MAR 16:33Z
    CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint
    cvelistv5