{"metadata": {"vulnerability": "CVE-2026-4858", "count": 25, "kinds": {"milestone": 5, "sighting": 6, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-03-25T15:58:42.714Z", "date_only": false, "value": "2026-03-25T15:58:42.714Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-4858", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-19T22:00:00Z", "date_only": false, "value": "2026-04-19T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-04-19T22:00:00Z", "date_only": false, "value": "2026-04-19T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-04-19T22:00:00Z", "date_only": false, "value": "2026-04-19T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-05-19T00:51:14Z", "date_only": false, "value": "2026-05-19T00:51:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-mattermost", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "9040264f-fdab-416d-9f39-a8c82b3c4573", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-mattermost"}, {"timestamp": "2026-05-20T22:00:00Z", "date_only": false, "value": "2026-05-20T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": false, "value": "2026-05-21T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-4858", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-21T00:00:00Z", "date_only": false, "value": "2026-05-21T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-4858", "record": "FKIE_CVE-2026-4858", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-21T08:12:11.176Z", "date_only": false, "value": "2026-05-21T08:12:11.176Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-4858", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-05-21T08:12:11.176Z", "date_only": false, "value": "2026-05-21T08:12:11.176Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Mattermost", "record": "CVE-2026-4858", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-21T09:16:30Z", "date_only": false, "value": "2026-05-21T09:16:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C4R7-J7PP-R8MP", "record": "GHSA-C4R7-J7PP-R8MP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-05-21T09:16:30.143Z", "date_only": false, "value": "2026-05-21T09:16:30.143", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-4858", "record": "FKIE_CVE-2026-4858", "field": "published"}, {"timestamp": "2026-05-21T09:32:12Z", "date_only": false, "value": "2026-05-21T09:32:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C4R7-J7PP-R8MP", "record": "GHSA-C4R7-J7PP-R8MP", "field": "published"}, {"timestamp": "2026-05-21T12:00:55.584Z", "date_only": false, "value": "2026-05-21T12:00:55.584789Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmeep2dusz2k", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "2b0c703a-6dd4-4408-850a-608a475b9b6f", "content": "\ud83d\udfe0 CVE-2026-4858 - High (8)\n\nMattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-4858/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmeep2dusz2k"}, {"timestamp": "2026-05-21T13:09:09.087Z", "date_only": false, "value": "2026-05-21T13:09:09.087377Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmeiipwgex2o", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "4cf49d92-dbe6-4c90-ac68-65cfa55bfa24", "content": "CVE-2026-4858 - Path traversal in integration action URL leading to arbitrary API execution via system admin\u2019s auth token.\nCVE ID : CVE-2026-4858\n \n Published : May 21, 2026, 9:16 a.m. | 3\u00a0hours, 1\u00a0minute ago\n \n Description : Mattermost versions 11.6.x <= 11.6.0, 11.5.x &lt...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmeiipwgex2o"}, {"timestamp": "2026-05-22T03:55:26.230Z", "date_only": false, "value": "2026-05-22T03:55:26.230Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-4858", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-22T03:55:26.230Z", "date_only": false, "value": "2026-05-22T03:55:26.230Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-4858", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-25T20:05:38.032Z", "date_only": false, "value": "2026-05-25T20:05:38.032+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.generator.date"}, {"timestamp": "2026-05-25T22:00:00Z", "date_only": false, "value": "2026-05-25T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-05-25T22:00:00Z", "date_only": false, "value": "2026-05-25T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-1173", "record": "WID-SEC-W-2026-1173", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-06-22T00:20:06.134Z", "date_only": false, "value": "2026-06-22T00:20:06.134949Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motmhez5pf2z", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "073fc731-ede0-4115-8a34-9394c6b55514", "content": "\ud83d\udea8  ALERT: CVE-2026-4858\n\nCVSS 8.0/10\n\n\ud83d\udccb WHAT IT IS:\nMattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user  to call an arbitrary API via system admin Mattermost auth t", "url": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motmhez5pf2z"}, {"timestamp": "2026-06-23T22:02:06Z", "date_only": false, "value": "2026-06-23T22:02:06Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C4R7-J7PP-R8MP", "record": "GHSA-C4R7-J7PP-R8MP", "field": "modified"}, {"timestamp": "2026-07-22T17:00:06.200Z", "date_only": false, "value": "2026-07-22T17:00:06.200215Z", "kind": "sighting", "label": "Seen", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "afc6c576-3843-4d9b-9ffc-043e4ff9d65d"}, {"timestamp": "2026-07-23T00:00:07.865Z", "date_only": false, "value": "2026-07-23T00:00:07.865485Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/B_YZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI", "record": "CVE-2026-4858", "field": "creation_timestamp", "uuid": "de0a8853-a78c-4e69-a577-4e860f1db50a"}, {"timestamp": "2026-07-23T16:10:00.137Z", "date_only": false, "value": "2026-07-23T16:10:00.137", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-4858", "record": "FKIE_CVE-2026-4858", "field": "lastModified"}]}