Vulnerabilities

CVSS

4.3 Medium

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Risk score

34.4

Published

2026-07-13

Status

Analyzed

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

Weaknesses

CWE-639

Coverage 1

vulnerability

Multiples vulnérabilités dans les produits Mattermost (15 juin 2026)

Multiple vulnerabilities have been discovered in Mattermost Server, potentially allowing an attacker to cause a security issue not specified by the vendor. These vulnerabilities could lead to data integrity and confident…

CERT-FR · Jun 15, 2026 Medium

CVE-2026-10085CVE-2026-10103CVE-2026-10106vulnerabilitymattermostsecurity

All articles mentioning it

Advisories and references

• mattermost.com/security-updates