CVE-2026-13426

{
  "id": "CVE-2026-13426",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-26T14:17:03.273",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path traversal components. Mattermost Advisory ID: MMSA-2025-00532"
    },
    {
      "lang": "es",
      "value": "El módulo Go de Mattermost github.com/mattermost/mattermost/server/public versiones anteriores a la v0.1.22 no validan los parámetros de ruta al construir rutas de API, lo que permite a un atacante redirigir llamadas a la API a puntos finales no deseados mediante IDs manipulados que contienen componentes de salto de ruta. ID de aviso de Mattermost: MMSA-2025-00532"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Mattermost",
          "product": "github.com/mattermost/mattermost/server/public",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "v0.0.0",
              "lessThan": "v0.1.22",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "v0.1.22",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-26T14:38:53.805003Z",
          "id": "CVE-2026-13426",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://mattermost.com/security-updates",
      "source": "[email protected]"
    }
  ]
}