Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T11:17:02.590Z",
  "pubdate": "2026-09-14T11:17:02.590Z",
  "executiveSummary": "A critical vulnerability exists in the Microsoft Calendar plugin for Mattermost that allows for an unauthenticated denial-of-service (DoS) attack. The flaw originates from improper input validation regarding null entries within Microsoft Graph webhook notification payloads.\nAffected versions include Mattermost 11.9.x (<= 11.9.0), 11.8.x (<= 11.8.4), 11.7.x (<= 11.7.7), and 10.11.x (<= 10.11.22).\nAn unauthenticated remote attacker can exploit this vulnerability by sending a maliciously crafted POST request to the application's public webhook endpoint. Successful exploitation results in the immediate termination of the Microsoft Calendar plugin process.\nThe primary risk implication is the complete loss of calendar integration services for all users on the affected Mattermost instance, as the plugin process remains unresponsive until recovery measures are taken. Given the lack of authentication required, this vulnerability presents a significant risk to service availability.",
  "technicalDetails": "The vulnerability resides within the request parsing logic of the Microsoft Calendar plugin, specifically in the component responsible for processing incoming Microsoft Graph webhook notifications. The root cause is a failure to implement adequate input validation for null-value entries within the JSON-encoded payload structure.\nWhen the Microsoft Calendar plugin receives a webhook notification, it expects a well-formed payload to correlate events with internal user calendars. The parsing logic lacks sufficient bounds checking or type validation for key-value pairs. By injecting null entries into specific fields of the webhook notification, an attacker can trigger an unhandled exception or a panic condition within the plugin's runtime environment.\nThe attack flow proceeds as follows: First, the attacker identifies the public-facing URL endpoint designated for Microsoft Graph webhooks. Second, the attacker crafts a synthetic POST request that adheres to the expected webhook schema but includes null pointers or explicitly null-valued fields that the plugin logic fails to handle gracefully. Third, the attacker transmits this crafted payload to the endpoint. Finally, the application processes the malformed data, leading to a process crash due to memory corruption or an unhandled null pointer dereference within the plugin's execution context.\nBecause the endpoint is exposed to the public internet to facilitate external communications from Microsoft's cloud infrastructure, no authentication or administrative privilege is required to initiate the request. The impact is specifically localized to the Microsoft Calendar plugin process. When the process crashes, the integration between Mattermost and Microsoft Calendar ceases to function globally across the instance. This prevents any synchronization or updates between the platforms, effectively denying service for all users dependent on the integration. Re-instantiation of the plugin is typically required to restore full service functionality."
}