CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.4. It affects GitHub.
CVE
CVE-2026-28735
Severity
MEDIUM
CVSS
5.4
EPSS
0.14%
GitHub
Original NVD Description
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL.. Mattermost Advisory ID: MMSA-2026-00628
Related CVEs
Other vulnerabilities affecting the same vendor(s)