CVE-2026-2461
MEDIUMMissing authorization check allows unauthorized modification of other users' comments on a board
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-2461. PoCs published by XiaomingX, destiny-creates.
AI-analyzed exploit summary The PoC exploits a vulnerability in telnet by injecting a crafted username parameter to achieve unauthorized access or command execution. It uses subprocess to execute a telnet command with a malicious username flag.
Description
Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised attacker with editor permission to modify comments created by other board members. Mattermost Advisory ID: MMSA-2025-00559
Exploits (2)
The PoC exploits a vulnerability in telnet by injecting a crafted username parameter to achieve unauthorized access or command execution. It uses subprocess to execute a telnet command with a malicious username flag.
This PoC exploits a vulnerability in telnet by injecting a malicious username parameter to potentially achieve remote code execution. The script prompts for a target IP and uses subprocess to execute a crafted telnet command.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N