CVE-2026-4858 is a high severity path traversal flaw (CVSS 8.0) in Mattermost Server. The integration action URL is not checked, so a malicious authenticated user can call an arbitrary API using a system admin token. Update to a release newer than the affected ones listed, and confirm the fix in the Mattermost bulletin.
What's affected
Mattermost Server 11.6.x up to 11.6.0, 11.5.x up to 11.5.3, 11.4.x up to 11.4.4, and 10.11.x up to 10.11.14. Mattermost's advisory ID is MMSA-2026-00640.
The security updates page loads its table with script, so we could not read the fixed versions from it. Anything newer than the highest affected patch in your line should include the fix, but confirm the exact release in the bulletin.
How to check if you're exposed
Read the server version and compare it with the lists above.
mmctl system version
The version also shows in the System Console, under About. Also review which integrations with action buttons exist, and who can create them.
What to do now
- Check your Mattermost version against the affected lines.
- Upgrade to a fixed release for your line, as listed in the Mattermost security updates bulletin for MMSA-2026-00640.
- Review custom integrations, slash commands and bots that use action URLs, and remove those you do not recognize.
- Limit who may create integrations, and review audit logs for unexpected API calls made through integration actions.
Why it matters
The class is CWE-22, path traversal. An integration action URL should point to the integration's own endpoint. When the server does not check it, a crafted path can steer the request elsewhere, and the record says the request carries a system admin token. That turns a user with ordinary access into a caller of admin level APIs.
The vector needs a low privilege account and a user interaction, and rates attack complexity high, but the scope is changed. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-4858 is a handy place to follow later updates.
Quick check
Who can exploit this?
The record says a malicious authenticated user. Anyone who can sign in to your workspace is therefore a possible source, which is why accounts and integration rights matter.
Sources
Last reviewed: 19 October 2026.
