What is GHSA-56v5-m3m2-x7qh?

GHSA-56v5-m3m2-x7qh is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22...

Which CVE IDs does GHSA-56v5-m3m2-x7qh cover?

GHSA-56v5-m3m2-x7qh covers the following CVE IDs: CVE-2026-10556. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-56v5-m3m2-x7qh?

GHSA-56v5-m3m2-x7qh has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-56v5-m3m2-x7qhMediumCVSS 5.3

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22...

Vendor

GitHub Security Advisories

Published

September 14, 2026

Last Modified

September 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-10556 →

📋 Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-10556
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-56v5-m3m2-x7qh