CVE-2026-16049

_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied_ {{post_id}}_, and fails to validate the_ {{web_url}} _parameter against the configured GitLab instance, which allows an authenticated attacker to inject bot-authored messages containing arbitrary URLs into channels they do not have access to via the_ {{createIssue}} _and_ {{attachCommentToIssue}} _API endpoints._ Mattermost Advisory ID: MMSA-2026-00673

We have discovered 241 live websites that are affected by CVE-2026-16049.

Run a Free Instant Scan



Affected Software

Product  Mattermost
Category Message Boards
Vulnerable Domains241 live websites (58% of Mattermost install base)
Vulnerable Versions
  • from 10 through 10.20.11
  • from 11.5 through 11.5.7
Vulnerable Versions Count34 versions ( 46% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 17, 2026
  • Updated - Aug 17, 2026

Credits

  • MindFlare007 (finder)

Website Distribution by Country

Number of websites using CVE-2026-16049
United States49 websites


Germany59 websites
Russia30 websites
France26 websites
Czech Republic11 websites
Singapore10 websites
GB7 websites
Switzerland6 websites
Canada5 websites

Website Distribution by TLD

Number of websites using CVE-2026-16049
.com44 websites
.ru40 websites
.org36 websites
.de20 websites
.net17 websites
.fr14 websites
.ch6 websites
.pl3 websites
.info3 websites
.se2 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-16049

Top websites that are affected by CVE-2026-16049. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.****.*****.**.us United States**,***
*********.org Germany***,***
****.*******.com GB***,***
**********.*********.org France***,***
****.*******.org France*,***,***
****.************.org Canada*,***,***
**********************.***.***.de Germany*,***,***
****.********.net GB*,***,***
**********.***.org United States*,***,***
**********.***.****.ch Switzerland*,***,***
See full domain list

FAQ

CVE-2026-16049 is Missing Authorization in Mattermost
A total of 241 websites have been identified as vulnerable to CVE-2026-16049, based on global website indexing conducted by WebTechSurvey.
The Mattermost is affected by the CVE-2026-16049 vulnerability.
Mattermost versions up to and including 11.5.7 are vulnerable to CVE-2026-16049.