https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T10:44:26.873723+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-6339 CVE-2026-6339 — Missing request origin validation on burn-on-read reveal endpoint 2026-10-08T10:44:26.889456+00:00

Affected: Mattermost

Mattermost versions 11.5.x <= 11.5.1, 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint which allows an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag.. Mattermost Advisory ID: MMSA-2026-00636