The vulnerability arises because certain site configuration variables are not properly escaped when composite error pages are rendered. If a value contains malicious JavaScript, it is injected into the page, allowing an attacker to execute code in the victim’s browser context. This flaw is a classic client‑side XSS described by CWE‑79, which can lead to credential theft, defacement, or session hijacking for users who view the error page.

Mattermost Mattermost is affected. Versions 11.5.x up to and including 11.5.1, and 10.11.x up to and including 10.11.13 contain the flaw. The issue is fixed in versions 11.6.0, 11.5.2, and 10.11.14 or later.

The CVSS score is 3.8, indicating low overall severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to have the ability to edit site configuration settings, a capability typically reserved for privileged users. Once configuration values are altered to contain JavaScript, any user who triggers the error page will have the code executed in their browser.