What is CVE-2026-10556?

CVE-2026-10556 is a medium-severity vulnerability in Mattermost, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 5.3/10. Published 2026-09-14.

How severe is CVE-2026-10556?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Mattermost

CVE-2026-10556

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Mattermost

Weakness classification (CWE)

CWE-754 — Improper Check for Unusual or Exceptional Conditions

References

responsibledisclosure@mattermost.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-10556?: CVE-2026-10556 is a medium-severity vulnerability in Mattermost, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 5.3/10. Published 2026-09-14.
How severe is CVE-2026-10556?: Medium severity. CVSS v3 base score is 5.3 out of 10.