Medium
Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
Type: advisorySources: OSV
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-10556
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 06:14 UTC · Revision 1
Source evidence
Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.
core-osv · Original sourcePublished 14 Sept 2026, 10:46 UTC
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693
osv:CVE-2026-10556
Complete source record
{
"id": "742e5274a9c0c0c4b0a3113e80b29632309f0e98050c8480f946457797516b12",
"url": "https://osv.dev/vulnerability/CVE-2026-10556",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.",
"summary": "Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693",
"evidence": "osv:CVE-2026-10556",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-10556",
"aliases": [
"CVE-2026-10556"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/mattermost/mattermost",
"type": "GIT",
"events": [
{
"introduced": "5b955468ea1ea8b56c0fb10feb258a36a767d7bb"
},
{
"fixed": "075d003e1391ff0b24eca1e63b0222eb46eaded6"
},
{
"introduced": "a9e574a82633915f22071f0d7ca2b006f249ec2a"
},
{
"fixed": "d42004bb3046de3ed176938a34b1a70c1c3d9421"
},
{
"introduced": "e8bd2b8a871cbeff6943bead62328478118188df"
},
{
"fixed": "d9c17e42b19c27dfac0ebe6840d954a41e626890"
},
{
"introduced": "583461af10fc9b2aef2871c722fc4376db695832"
},
{
"fixed": "1f738d345805168964a55e5860aac9c747dceb78"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.11.0"
},
{
"fixed": "10.11.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.7.0"
},
{
"fixed": "11.7.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.8.0"
},
{
"fixed": "11.8.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "11.9.0"
},
{
"fixed": "11.9.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v11.8.4",
"v11.7.7",
"v10.11.22",
"v11.9.0",
"mattermost-redux@11.9.0",
"@mattermost/types@11.9.0",
"@mattermost/shared@11.9.0",
"@mattermost/client@11.9.0",
"v11.8.3",
"v10.11.21",
"v11.7.6",
"v11.8.2",
"v11.7.5-rc1",
"v11.7.5",
"v11.8.1",
"v11.7.4",
"v11.7.3",
"v10.11.20",
"v11.8.0-rc5",
"v11.8.0",
"mattermost-redux@11.8.0",
"@mattermost/types@11.8.0",
"@mattermost/shared@11.8.0",
"@mattermost/client@11.8.0",
"v10.11.19",
"v10.11.19-rc1",
"v11.7.2",
"v10.11.18",
"v11.7.1",
"v10.11.17",
"v10.11.16",
"v11.7.0",
"mattermost-redux@11.7.0",
"@mattermost/types@11.7.0",
"@mattermost/shared@11.7.0",
"@mattermost/client@11.7.0",
"v10.11.15-rc1",
"v10.11.15",
"v10.11.14",
"v10.11.14-rc1",
"v10.11.13",
"v10.11.13-rc1",
"v10.11.12",
"v10.11.11-rc2",
"v10.11.11",
"v10.11.11-rc1",
"v10.11.10",
"v10.11.9",
"v10.11.9-rc1",
"v10.11.8",
"v10.11.7",
"v10.11.6",
"v10.11.5",
"v10.11.4-rc3",
"v10.11.4",
"v10.11.4-rc2",
"v10.11.4-rc1",
"v10.11.3",
"v10.11.2-rc2",
"v10.11.2",
"v10.11.2-rc1",
"v10.11.1",
"v10.11.1-rc1",
"v10.11.0-rc3",
"v10.11.0",
"mattermost-redux@10.11.0",
"@mattermost/types@10.11.0",
"@mattermost/client@10.11.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-10556.json"
}
}
],
"modified": "2026-10-28T02:30:26.198725561Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10556.json",
"https://mattermost.com/security-updates",
"https://nvd.nist.gov/vuln/detail/CVE-2026-10556"
],
"provider_metadata": {
"cwe_ids": [
"CWE-754"
],
"cna_assigner": "Mattermost",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "11.9.0"
},
{
"last_affected": "11.9.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "11.8.0"
},
{
"last_affected": "11.8.4"
},
{
"introduced": "11.7.0"
},
{
"last_affected": "11.7.7"
},
{
"introduced": "10.11.0"
},
{
"last_affected": "10.11.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10556.json"
}
},
"related_cves": [
{
"value": "CVE-2026-10556",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 492999,
"published_at": "2026-09-14T10:46:01.186+00:00"
}