What is the CVSS score of CVE-2026-10103?

CVE-2026-10103 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Mattermost CVE-2026-10103

EUVD-2026-43307 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-13 Mattermost

GHSA-4h7j-7xp4-wp5p

Authentication Bypass Mattermost

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Remote cluster must hold authenticated federation credentials (PR:L); only post integrity within shared channels is impacted, with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:00 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

AnalysisAI

Post ownership verification is absent in Mattermost's shared channel inbound sync handler, allowing an authenticated remote cluster to forge sync messages that modify or delete posts authored by local users or other federated remotes. Affected versions span the 10.11.x, 11.6.x, and 11.7.x release trains up to and including 10.11.19, 11.6.4, and 11.7.2 respectively. No public exploit has been identified and CISA KEV confirmation is absent, but the integrity impact is direct and the attack complexity is low once federation trust is established.

Technical ContextAI

Mattermost's shared channels feature enables cross-instance federation, synchronizing posts between separate Mattermost deployments (remote clusters) via an inbound sync handler. The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key): the sync handler accepts post IDs supplied by the remote cluster in crafted sync messages and processes ownership-sensitive operations (edit, delete) against those IDs without confirming that the requesting remote cluster is the original author or has been delegated write rights over the referenced post. The affected CPE is cpe:2.3:a:mattermost:mattermost across all qualifying versions. The flaw is architectural - the trust boundary between remote clusters is not enforced at the object level, only at the channel membership level.

RemediationAI

The primary remediation is to upgrade to a patched Mattermost release; exact fixed version numbers are not explicitly enumerated in the available reference data and must be confirmed at https://mattermost.com/security-updates (MMSA-2026-00689) - patch available per vendor advisory. As a compensating control for environments that cannot patch immediately, disabling the shared channels (federation) feature eliminates the vulnerable code path entirely, though this will halt cross-instance post synchronization for all configured remote clusters. Restricting which remote clusters are trusted at the network or application level (allowlisting known-good peer instances) reduces the attack surface but does not eliminate the vulnerability if a trusted peer is compromised. There are no known side-channel workarounds that preserve full shared channel functionality while mitigating the flaw.