What is the CVSS score of CVE-2026-27769?

CVE-2026-27769 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-27769?

Yes, a patch is available for CVE-2026-27769. Update the affected software to the latest version immediately.

Mattermost CVE-2026-27769

Q: Which versions of Mattermost are affected by CVE-2026-27769?

Mattermost versions 10.11.0 through 10.11.12 fail to validate workspace ownership during Connected Workspaces API interactions, allowing a malicious remote server with high privileges to modify the…. A patch is available.

EUVD-2026-22873 LOW

Missing Authorization (CWE-862)

2026-04-15 Mattermost

Authentication Bypass Mattermost

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 10:56 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22873

Analysis Generated

Apr 15, 2026 - 10:45 vuln.today

CVE Published

Apr 15, 2026 - 10:11 nvd

LOW 2.7

DescriptionCVE.org

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API.. Mattermost Advisory ID: MMSA-2026-00603

AnalysisAI

Mattermost versions 10.11.0 through 10.11.12 fail to validate workspace ownership during Connected Workspaces API interactions, allowing a malicious remote server with high privileges to modify the displayed status of local users. This affects organizations using the Connected Workspaces federation feature and requires an attacker to already possess high administrative privileges on a connected remote instance. The vulnerability has CVSS 2.7 (low severity) and no public exploit code or active exploitation has been identified.

Technical ContextAI

Mattermost's Connected Workspaces feature enables federation between multiple Mattermost instances via API communication. The vulnerability stems from insufficient authorization checks (CWE-862: Missing Authorization) when processing user status updates through the Connected Workspaces API endpoints. The affected code fails to verify that a requesting remote workspace actually owns or has legitimate authority over the user account being modified. This is a cross-workspace authorization flaw where the application trusts a remote peer without validating the relationship between the remote server's credentials and the target user resource. CPE cpe:2.3:a:mattermost:mattermost indicates all Mattermost product installations running versions 10.11.0 through 10.11.12.

RemediationAI

Upgrade Mattermost to a patched version released after 10.11.12. Consult the Mattermost security advisory at https://mattermost.com/security-updates for the exact fixed version (not independently confirmed from provided data). As an interim mitigation, restrict Connected Workspaces federation to trusted peer instances only and audit user status change logs for unauthorized modifications. Disable Connected Workspaces feature entirely if federation is not required for operational needs. No workaround is available for organizations that must maintain federated workspace connectivity.