Answer in brief
CVE-2026-6046 records a Medium severity vulnerability in Mattermost doesn't validate that a username returned during bot registration belongs to a bot account. The current sources do not mark it as known exploited. The current feed maps github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost-server (go), github.com/mattermost/mattermost/server/v8 (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| github.com/mattermost/mattermost-servergo | =11.6.0 | 11.6.1 |
| github.com/mattermost/mattermost-servergo | >=11.5.0,<=11.5.4 | 11.5.5 |
| github.com/mattermost/mattermost-servergo | >=10.11.0,<=10.11.15 | 10.11.17 |
| github.com/mattermost/mattermost/server/v8go | >=8.0.0-20250731163400-5b955468ea1e,<8.0.0-20260428151657-c79c3831061a | 8.0.0-20260428151657-c79c3831061a |
Published upstream
Jun 12, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Aug 24, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Aug 25, 2026
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to validate that a username returned during bot registration belongs to a bot account, which allows an unprivileged attacker to intercept private messages sent by plugins via direct message channels by pre-registering a user account with a predictable plugin bot username. Mattermost Advisory ID: MMSA-2026-00649
Quoted source text, attributed separately from HOL analysis.