CVE-2026-7184
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 12, 2026
Vendor
unknown
Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the { {manage_secure_connections} } permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662