Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

published 2026-09-14 56 d ago modified 2026-10-07 33 d ago also EUVD-2026-77379

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits: 0; none known

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

Patch / fix

fixed in 1

Mattermost Mattermost 10.11.23, 11.7.8, 11.8.5, 11.9.1, 11.10.0

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 56 d ago (2026-09-14)

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Mattermost Mattermost

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions
CWE-476 NULL Pointer Dereference

References

mattermost.com /security-updates
vendor-advisory

Sources

CVE List CVE-2026-10556
NVD CVE-2026-10556

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary