What is the CVSS score of CVE-2026-10106?

CVE-2026-10106 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-10106

Q: Which versions of Mattermost are affected by CVE-2026-10106?

Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of.

EUVD-2026-43312 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-13 Mattermost

GHSA-vvv9-9jm4-76jg

Authentication Bypass Mattermost

6.5

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable by any authenticated user (PR:L, AV:N, AC:L); integrity is high as unauthorized post actions can alter application state; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 09:04 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel via a cookie obtained from any accessible channel.. Mattermost Advisory ID: MMSA-2026-00690

AnalysisAI

Incorrect authorization in Mattermost's interactive post action handler allows authenticated users to trigger post actions in private channels they are not members of. The flaw stems from action cookies failing to bind to the specific channel of the target post - a cookie obtained from any accessible channel can be reused against posts in restricted private channels. Affected are Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19; no public exploit has been identified and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Mattermost is an open-source team messaging and collaboration platform deployed both on-premises and as SaaS. Its interactive post actions feature allows integrations and bots to embed clickable buttons and menus in channel posts; these actions are authorized server-side using signed action cookies that encode channel context. The root cause is CWE-863 (Incorrect Authorization): the server validates the cryptographic integrity of the cookie but does not enforce that the cookie's embedded channel ID matches the channel containing the target post. This breaks the authorization boundary between channels, as the channel-scoping constraint is decorative rather than enforced. CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers all Mattermost application variants across the affected version ranges.

RemediationAI

Upgrade to a patched release above the affected version ceilings per the Mattermost advisory at https://mattermost.com/security-updates. Specific fixed version numbers are not confirmed in the available input data - consult the vendor advisory directly to identify the minimum safe release for each branch (11.7.x, 11.6.x, 10.11.x). If immediate patching is not possible, a targeted compensating control is to audit and remove or disable interactive post actions (bot integrations with button/menu posts) from sensitive private channels, eliminating the exploitable attack surface. This workaround has the trade-off of disrupting automation workflows. Restricting Mattermost account creation and enforcing minimum user privilege can also raise the bar for exploitation, since PR:L requires an authenticated account.