---
id: CVE-2026-10556
title: >-
  Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7,
  10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook
  notification payloads, which allows an unauthenticated attacker to crash the
  Microsoft…
summary: >-
  Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7,
  10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook
  notification payloads, which allows an unauthenticated attacker to crash the
  Microsoft…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-754
  - CWE-476
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.23'
  - 'mattermost_server >= 11.7.0, < 11.7.8'
  - 'mattermost_server >= 11.8.0, < 11.8.5'
  - 'mattermost_server >= 11.9.0, < 11.9.1'
patched:
  - mattermost_server 11.9.1
published: '2026-09-14'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T16:25:31.660'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10556'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
  - cve.org
epss: 0.0042
epssPercentile: 0.36505
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T11:04:06.098806Z'
ingestedAt: '2026-09-14T15:23:07.462Z'
---

## Overview

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

## Affected

- `mattermost_server >= 10.11.0, < 10.11.23`
- `mattermost_server >= 11.7.0, < 11.7.8`
- `mattermost_server >= 11.8.0, < 11.8.5`
- `mattermost_server >= 11.9.0, < 11.9.1`

## Remediation

Upgrade past the affected range:

- `mattermost_server 11.9.1`