Mattermost versions 11.7.x up to and including 11.7.10 allow the OpenID discovery endpoint to bypass outbound internal‑connection filtering, enabling a system administrator to issue SSRF requests that expose whether internal addresses and ports are reachable from the server. This results in an SSRF vulnerability that can facilitate internal network reconnaissance and potentially more extensive internal attacks. The weakness is identified by CWE‑918, Server‑Side Request Forgery.

The affected product is Mattermost Mattermost. Vulnerable releases are the 11.7 series from 11.7.0 through 11.7.10 inclusive, as well as any earlier 11.7.x releases that were not patched. The fix is provided in Mattermost releases 11.7.11 and 11.11.0 or later.

The CVSS score of 2.7 rates this as low severity, indicating that exploitation is not widely reported. However, because the attack requires a system administrator or similarly privileged user to trigger the vulnerable endpoint, the risk is primarily limited to insider threats or compromised administrative credentials. The vulnerability is not listed in the CISA KEV catalog, which further reduces the likelihood of widespread active exploitation.