# CVE-2026-27659: server CSRF — Fixed in 11.4.1 🐹 🐹 Go Not in CISA KEV MEDIUM severity # CVE-2026-27659 — server MEDIUM CVE-2026-27659 is a medium-severity (CVSS 4.6) Cross-Site Request Forgery (CSRF) vulnerability in github.com/mattermost/mattermost/server/v8. A fix is available for github.com/mattermost/mattermost/server/v8 — see the affected versions and patch details below. CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint Also known as[GHSA-rmhw-c3xr-m3xx](/vulnerability/GHSA-rmhw-c3xr-m3xx)GO-2026-5629 Published Mar 25, 2026 Updated Nov 7, 2026 Affected 5 pkgs Patched 5 / 5 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27659. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.1%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs2th percentile — riskier than 2% of all scored CVEsHighest risk 0.00%0.24%0.48%0.72%0.0%0.1%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 5 pkgs affected 🐹`github.com/mattermost/mattermost/server/v8`🐹`github.com/mattermost/mattermost/server/v8`🐹`github.com/mattermost/mattermost/server/v8`🐹`github.com/mattermost/mattermost/server/v8`🐹`github.com/mattermost/mattermost/server/v8` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems. ## Description Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access\_control\_policies/{policy\_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578 ## Affected Packages 5 total 5 fixed Ecosystem Package Vulnerable range Fix 🐹Go `github.com/mattermost/mattermost/server/v8` ≥ 11.4.0-rc1&&< 11.4.1 11.4.1`go get github.com/mattermost/mattermost/server/v8@v11.4.1` 🐹Go `github.com/mattermost/mattermost/server/v8` ≥ 11.3.0-rc1&&< 11.3.2 11.3.2`go get github.com/mattermost/mattermost/server/v8@v11.3.2` 🐹Go `github.com/mattermost/mattermost/server/v8` ≥ 11.2.0-rc1&&< 11.2.3 11.2.3`go get github.com/mattermost/mattermost/server/v8@v11.2.3` 🐹Go `github.com/mattermost/mattermost/server/v8` ≥ 10.11.0-rc1&&< 10.11.11 10.11.11`go get github.com/mattermost/mattermost/server/v8@v10.11.11` 🐹Go `github.com/mattermost/mattermost/server/v8` ≥ 8.0.0-20260105080200-d27a2195068d&&< 10.11.11 10.11.11`go get github.com/mattermost/mattermost/server/v8@v10.11.11` ## Affected Products 1 product · 4 configurations Application `mattermost server`mattermost ≥ 11.4.0 && < 11.4.1 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/mattermost/mattermost/server/v8, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update github.com/mattermost/mattermost/server/v8 to 11.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27659 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access\_control\_policies/{policy\_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578 O3 Security · Impact-Aware SCA ### Is CVE-2026-27659 in your dependencies? Find it across Go, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)