CVE-2026-10556
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Mattermost
- Vendor
- Mattermost
- Product
- Mattermost
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 11.9.0 | affected | semver | Unavailable | 11.9.0 | None listed |
| 11.8.0 | affected | semver | Unavailable | 11.8.4 | None listed |
| 11.7.0 | affected | semver | Unavailable | 11.7.7 | None listed |
| 10.11.0 | affected | semver | Unavailable | 10.11.22 | None listed |
| 11.10.0 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.9.1 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.8.5 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 11.7.8 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
| 10.11.23 | unaffected | Unavailable | Unavailable | Unavailable | None listed |