What is the CVSS score of CVE-2026-28759?

CVE-2026-28759 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28759?

Yes, a patch is available for CVE-2026-28759. Update the affected software to the latest version immediately.

Mattermost CVE-2026-28759

Q: Which versions of Mattermost are affected by CVE-2026-28759?

Authorization bypass in Mattermost shared channel synchronization allows authenticated remote cluster administrators to remove arbitrary users from any channel, including private channels outside the…. A patch is available.

EUVD-2026-30738 MEDIUM

Incorrect Authorization (CWE-863)

2026-05-18 Mattermost

GHSA-8h9w-w78c-vvr3

Mattermost Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:16 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576

AnalysisAI

Authorization bypass in Mattermost shared channel synchronization allows authenticated remote cluster administrators to remove arbitrary users from any channel, including private channels outside the attacker's authorization scope. Affects versions 11.5.x through 11.5.1, 10.11.x through 10.11.13, and 11.4.x through 11.4.3. CVSS 4.3 reflects the low-privilege requirement (authenticated remote cluster) and limited impact scope (integrity only, no data exposure), though cross-tenant authorization violations in collaboration platforms warrant attention. EPSS data unavailable; no public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

This vulnerability stems from incorrect authorization (CWE-863) in Mattermost's shared channel synchronization protocol. Shared channels enable federated collaboration between separate Mattermost server clusters, with membership sync messages propagating user additions/removals across cluster boundaries. The affected code path fails to verify that a remote cluster has legitimate access to a target channel before processing membership removal requests. According to the CPE data (cpe:2.3:a:mattermost:mattermost), this affects the core Mattermost server application across three maintenance branches. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation with low attack complexity once an attacker controls an authenticated remote cluster connection. The authorization gap allows privilege escalation beyond intended federation boundaries, violating the principle that cluster-to-cluster trust should not grant unrestricted access to all channels.

RemediationAI

Upgrade to Mattermost version 11.5.2, 10.11.14, or 11.4.4 (specific patch versions inferred from vulnerable version ranges but not independently confirmed-verify exact fix versions at https://mattermost.com/security-updates before deployment). Organizations unable to immediately patch should implement the following compensating controls: disable shared channel functionality entirely via System Console > Experimental > Features > Enable Shared Channels (set to false), which eliminates remote cluster attack surface but breaks federated collaboration workflows; alternatively, audit and restrict remote cluster connections to only trusted partner organizations via System Console > Shared Channels, removing any untrusted or compromised remote clusters from the allowlist. Monitor channel membership changes via audit logs for unexpected removals, particularly in private channels, as indicators of exploitation attempts. Note that disabling shared channels prevents legitimate cross-cluster collaboration and may disrupt business workflows dependent on federation-coordinate with stakeholders before implementing. No workaround exists to selectively protect individual channels while maintaining shared channel functionality, as the vulnerability exists in the core authorization check of the sync protocol.