What is the CVSS score of CVE-2026-3637?

CVE-2026-3637 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3637?

Yes, a patch is available for CVE-2026-3637. Update the affected software to the latest version immediately.

Mattermost CVE-2026-3637

Q: Which versions of Mattermost are affected by CVE-2026-3637?

Privilege escalation in Mattermost Server allows authenticated users with revoked channel posting permissions to continue modifying their existing posts.. A patch is available.

EUVD-2026-30741 MEDIUM

Missing Authorization (CWE-862)

2026-05-18 Mattermost

GHSA-v549-xx3c-6pc8

Mattermost Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 08:16 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

AnalysisAI

Privilege escalation in Mattermost Server allows authenticated users with revoked channel posting permissions to continue modifying their existing posts. Affected versions include 11.5.0-11.5.1, 10.11.0-10.11.13, and 11.4.0-11.4.3. Attackers bypass authorization controls by sending direct API requests to post update and patch endpoints, circumventing permission checks that should prevent post edits after privileges are revoked. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. CVSS 4.3 (Medium) reflects low integrity impact limited to existing content modification.

Technical ContextAI

This vulnerability stems from missing authorization checks (CWE-862: Missing Authorization) in Mattermost's post editing workflow. When administrators revoke a user's create_post permission for a channel, the system correctly blocks new post creation but fails to validate these same permissions during edit operations. The /posts/{post_id} update and PATCH endpoints lack proper permission re-validation, allowing users to retain edit capabilities on their historical posts even after authorization revocation. This represents a classic privilege persistence issue where authorization decisions are not consistently enforced across related API operations. The flaw affects Mattermost Server's core messaging functionality across multiple long-term support branches (10.11.x, 11.4.x) and the current release series (11.5.x), indicating the authorization gap exists in shared codebase components handling post lifecycle management.

RemediationAI

Upgrade to patched Mattermost Server versions as specified in vendor advisory MMSA-2026-00627 at https://mattermost.com/security-updates (exact fixed versions not provided in available data but typically follow semantic versioning pattern of 11.5.2, 10.11.14, and 11.4.4 based on affected ranges). Until patching is complete, implement compensating controls by monitoring API access logs for unusual patterns of post update/patch requests from users with recently revoked permissions, though this provides only detection capability, not prevention. Consider implementing additional reverse proxy rules to enforce permission checks at the edge layer before requests reach application endpoints, though this requires custom development and may impact legitimate edit workflows. Note that no workaround fully mitigates the vulnerability without code-level fixes. Organizations with high message integrity requirements should prioritize rapid patching over compensating controls due to the ease of exploitation via standard API clients.