What is the CVSS score of CVE-2026-10085?

CVE-2026-10085 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-10085

EUVD-2026-43311 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Mattermost

GHSA-6v2h-jj3h-8gmx

Authentication Bypass Mattermost

5.4

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible API requires only a low-privilege authenticated account; no confidentiality impact as no data is exposed, only destructive participant removal causing integrity and availability disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:03 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688

AnalysisAI

Mattermost's channel patch API fails to enforce authorization on the group_constrained flag, permitting any authenticated low-privilege member of a group message or direct message channel to remove all participants from the conversation. All three supported release lines are affected: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code has been identified at time of analysis; however, the low attack complexity and minimal privilege requirement make this straightforward to abuse on any reachable Mattermost deployment.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization) - the server-side channel patch API endpoint does not validate that the group_constrained flag is only a meaningful and permissible control for public or private channels that have group synchronization enabled. In Mattermost's architecture, group_constrained is a flag that restricts channel membership to members of a linked group, and it is semantically inapplicable to direct message (DM) or group message channels. Because the authorization check is absent, an API caller with ordinary channel membership can submit a PATCH request toggling this flag on a DM or group message channel, triggering the server to remove all participants as a side effect of applying the flag to an unsupported channel type. The affected CPE is cpe:2.3:a:mattermost:mattermost across multiple minor version branches.

RemediationAI

Upgrade Mattermost to the next patched release above the affected upper bounds - beyond 11.7.2 in the 11.7.x line, beyond 11.6.4 in the 11.6.x line, and beyond 10.11.19 in the 10.11.x line. Exact fixed version numbers are not specified in the input data; consult the Mattermost security page at https://mattermost.com/security-updates (advisory MMSA-2026-00688) to confirm the precise remediated release for your branch before upgrading. If immediate upgrade is not feasible, consider restricting API-level access to the channel patch endpoint for non-administrative roles at the reverse proxy or firewall layer - note this may break legitimate channel management workflows for users and should be treated as a temporary control only. Monitoring for unexpected PATCH requests to the channels API that include the group_constrained field originating from non-admin users can assist in detecting exploitation attempts in the interim.