Mattermost validiert CSRF-Token nicht auf einem Authentifizierungsendpunkt

Successful exploitation of CVE-2026-28741 allows an attacker to modify a user's authentication method within a Mattermost instance. This could involve changing password reset mechanisms, enabling or disabling multi-factor authentication, or even altering the primary authentication provider. The impact is significant as it can lead to unauthorized access to user accounts and potentially compromise the entire Mattermost environment. An attacker could craft a phishing page that, when visited by a legitimate user, silently submits a request to change their authentication settings, granting the attacker control over their account. This vulnerability highlights the importance of robust CSRF protection in all web applications, particularly those handling sensitive user data and authentication processes.

Organizations utilizing Mattermost for team communication, particularly those with legacy deployments running vulnerable versions (10.11.0–11.5.1). Shared hosting environments where multiple users share a Mattermost instance are also at increased risk, as a compromised user could potentially affect other users on the same server.

• linux / server:

journalctl -u mattermost -f | grep -i "csrf"

• generic web:

curl -I https://<mattermost_url>/auth/change_method | grep -i "csrf-token"

• wordpress / composer / npm: (Not applicable, as Mattermost is not a WordPress plugin or Node.js package) • database (mysql, redis, mongodb, postgresql): (Not applicable, as the vulnerability does not directly involve database interaction) • windows / supply-chain: (Not applicable, as Mattermost is not a Windows application)

1. 2026-04-15Disclosure

   disclosure

1. Reserviert2026-03-10
2. Veröffentlicht2026-04-15
3. EPSS aktualisiert2026-04-22

The primary mitigation for CVE-2026-28741 is to upgrade Mattermost to version 11.5.1 or later. If immediate upgrading is not possible, consider implementing temporary workarounds such as strict Content Security Policy (CSP) headers to restrict the origins from which scripts can be executed. Additionally, review and strengthen user awareness training to educate users about the risks of phishing attacks and malicious links. Monitor Mattermost logs for suspicious activity, particularly requests related to authentication settings. While a direct detection signature is difficult to create, unusual authentication method changes should trigger alerts. After upgrading, confirm the fix by attempting a CSRF attack against the authentication endpoint using a tool like Burp Suite and verifying that the request is rejected.