What is the CVSS score of CVE-2026-10106?

CVE-2026-10106 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-10106

Q: Which versions of Mattermost are affected by CVE-2026-10106?

Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of.

EUVD-2026-43312 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-13 Mattermost

GHSA-vvv9-9jm4-76jg

Authentication Bypass Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable by any authenticated user (PR:L, AV:N, AC:L); integrity is high as unauthorized post actions can alter application state; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:04 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel via a cookie obtained from any accessible channel.. Mattermost Advisory ID: MMSA-2026-00690

AnalysisAI

Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of. The flaw stems from action cookies failing to bind to the specific channel of the target post - a cookie obtained from any accessible channel can be reused against posts in restricted private channels. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Mattermost as low-privilege user

Delivery

Access interactive post in any permitted channel

Exploit

Capture action cookie from accessible channel

Execution

Enumerate or guess target post ID in private channel

Persist

Submit action request with cross-channel cookie

Impact

Server executes unauthorized post action in private channel

Access

Authenticate to Mattermost as low-privilege user

Delivery

Access interactive post in any permitted channel

Exploit

Capture action cookie from accessible channel

Execution

Enumerate or guess target post ID in private channel

Persist

Submit action request with cross-channel cookie

Impact

Server executes unauthorized post action in private channel

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a valid authenticated Mattermost session (confirmed by PR:L in CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates a network-exploitable flaw requiring only low-level authentication and no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Mattermost user with membership in at least one channel containing interactive post actions captures a valid action cookie from that channel. They then craft a POST request targeting a post ID located in a private channel they are not a member of, submitting the cross-channel cookie. …
Remediation	Upgrade to a patched release above the affected version ceilings per the Mattermost advisory at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report.