Mattermost server versions 11.9.x (up to 11.9.1), 11.8.x (up to 11.8.5), 11.7.x (up to 11.7.10) and 11.10.x (up to 11.10.1) do not apply the internal‑connection filter to OAuth endpoint requests. This allows a System Administrator who can configure OAuth endpoints to cause the server to issue HTTP requests to internal network addresses and read the responses via the configured OAuth token and userinfo endpoints. The impact is a server‑side request forgery that can expose sensitive internal data or access services behind firewalls.

Mattermost Mattermost server software versions 11.9.0 through 11.9.1, 11.8.0 through 11.8.5, 11.7.0 through 11.7.10, and 11.10.0 through 11.10.1 are affected. Updated versions 11.11.0, 11.9.2, 11.8.6, 11.7.11, and 11.10.2 or newer contain the fix.

The CVSS score of 5.5 indicates moderate severity. The vulnerability is not listed in CISA KEV and no EPSS value is available, implying low to moderate exploitation likelihood. The likely attack path requires a privileged System Administrator who can modify OAuth configuration; an attacker with such privileges can trigger internal requests and read responses. No publicly disclosed exploits are known, but the flaw could be leveraged to gather internal information or access resources not exposed to the public internet.