Mattermost versions through 10.11.14, 11.4.4, 11.5.3, and 11.6.0 do not properly validate the scope of OAuth tokens returned by GitHub. The flaw allows an authenticated Mattermost user to alter the scope parameter in the GitHub authorization URL during the callback process, thus receiving an access token with permissions to private repositories. This grants the user unauthorized read access to sensitive repositories and their contents.

Affected products are Mattermost releases: 10.11.x through 10.11.14, 11.4.x through 11.4.4, 11.5.x through 11.5.3, and 11.6.x through 11.6.0.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited evidence of exploitation in the wild. An attacker must be an authenticated user of Mattermost and must have access to the OAuth flow; no remote code execution or privilege escalation is required. The risk is confined to the potential exposure of private repository data by users who can manipulate the OAuth request.