cve.bz

CVE-2026-10556

5.3 mediumEPSS 0.4%

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

CVSS 3.1
5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS
0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-25)
CWEs
CWE-476, CWE-754
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON