EUVD-2026-77366
GHSA-462g-wr4w-p54m
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
IDOR via API call needs only a valid action ID (AC:L); no availability impact results from modifying channel action configuration.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
2DescriptionCVE.org
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692
AnalysisAI
Missing channel action ownership validation in Mattermost allows an authenticated channel manager to overwrite workflow automation actions belonging to channels outside their management scope via the channel action update API endpoint. Affected releases span four active branches: 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Mattermost session with channel manager role privileges in at least one channel on the target server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 5.0 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) is broadly reasonable: network-accessible, low-privilege attacker, no user interaction, with partial impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a version beyond the stated affected ceiling: 10.11.23 or later for the 10.11.x ESR line, 11.7.8 or later for the 11.7.x line, 11.8.5 or later for the 11.8.x line, or 11.9.1 or later for the 11.9.x line - these fix versions are inferred from the affected-version boundaries in MMSA-2026-00692 and have not been independently verified as released. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Share
External POC / Exploit Code
Leaving vuln.today