What is the CVSS score of CVE-2026-10103?

CVE-2026-10103 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Mattermost CVE-2026-10103

EUVD-2026-43307 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 Mattermost

GHSA-4h7j-7xp4-wp5p

Authentication Bypass Mattermost

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Remote cluster must hold authenticated federation credentials (PR:L); only post integrity within shared channels is impacted, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:00 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

AnalysisAI

Post ownership verification is absent in Mattermost's shared channel inbound sync handler, allowing an authenticated remote cluster to forge sync messages that modify or delete posts authored by local users or other federated remotes. Affected versions span the 10.11.x, 11.6.x, and 11.7.x release trains up to and including 10.11.19, 11.6.4, and 11.7.2 respectively. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Control or compromise federated remote cluster

Delivery

Craft inbound sync message with arbitrary post ID

Exploit

Submit message to target's shared channel sync handler

Execution

Handler processes modification without ownership check

Impact

Modify or delete victim user's post

Access

Control or compromise federated remote cluster

Delivery

Craft inbound sync message with arbitrary post ID

Exploit

Submit message to target's shared channel sync handler

Execution

Handler processes modification without ownership check

Impact

Modify or delete victim user's post

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to control or compromise a Mattermost remote cluster that has an established, administratively configured shared channel relationship with the target instance - this is a non-default feature requiring explicit setup by system administrators on both sides. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned and NVD-recorded CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N yields a score of 4.3 (Medium), which accurately reflects the constrained blast radius: exploitation is network-reachable (AV:N), requires no special conditions beyond established federation (AC:L), but demands an authenticated remote cluster credential (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who controls or has compromised an authenticated Mattermost remote cluster federated with a target organization sends crafted inbound sync messages to the target's shared channel sync handler, embedding arbitrary post IDs belonging to local users or other remotes. Because the handler does not verify post ownership, the target instance processes the modification or deletion as legitimate, silently altering or erasing message history in the shared channel without any action required from the victim users.
Remediation	The primary remediation is to upgrade to a patched Mattermost release; exact fixed version numbers are not explicitly enumerated in the available reference data and must be confirmed at https://mattermost.com/security-updates (MMSA-2026-00689) - patch available per vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report.