CVE-2026-28735CWE-863

GitHub OAuth Scope Validation

Medium · published May 22, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-22T16:26Z
EPSS history
Timeline
  • 22 MAY 16:26Z
    GitHub OAuth Scope Validation
    cvelistv5