CERT-Bund groups 14 Mattermost flaws into one advisory

Germany's CERT-Bund, the federal computer emergency response team run by the BSI (Federal Office for Information Security), has published an advisory covering 14 separate vulnerabilities in Mattermost, the self-hosted team chat platform favoured by organisations that want to keep message history on their own servers. All are fixed in releases already available.

What they found

• The advisory, WID-SEC-2026-4009 of 15 October 2026, groups 14 CVE (Common Vulnerabilities and Exposures) entries and is rated medium severity overall.
• Together the flaws could let an attacker bypass security controls, gain higher privileges, trigger a denial of service, disclose information or tamper with files.
• Five release branches are affected: versions before 11.7.10, 11.8.6, 11.9.2, 11.10.1 and 11.11.0, on Linux, UNIX, Windows and other systems.
• Each flaw is also indexed in ENISA's European Union Vulnerability Database, the EU's own public register.

What to do

• Upgrade to the fixed release for your branch: 11.7.10, 11.8.6, 11.9.2, 11.10.1 or 11.11.0.
• Read Mattermost's security updates page for per-flaw detail before scheduling the work.
• Keep self-hosted chat servers in the normal patching cycle; they hold message archives, shared files and sign-on sessions.

Source: Mattermost: multiple vulnerabilities (Mattermost: Mehrere Schwachstellen), CERT-Bund, 15 October 2026. Summary by the Cyber Risk Barometer.