Vulnerabilities

CVSS

6.4 Medium

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Risk score

51.2

Published

2026-06-22

Status

Published

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650

Weaknesses

CWE-639

Coverage 1

vulnerability

Multiples vulnérabilités dans les produits Mattermost (22 mai 2026)

Multiple vulnerabilities have been discovered in Mattermost products, allowing an attacker to bypass security policies and potentially lead to an unspecified security issue. These vulnerabilities affect various versions…

CERT-FR · May 22, 2026 Medium

CVE-2026-5139CVE-2026-6062CVE-2026-6517vulnerabilitysecuritypatch

All articles mentioning it

Advisories and references

• mattermost.com/security-updates