Mattermost CVE-2026-4274

Multiple intelligence signals indicate this is a lower-priority vulnerability despite its moderate CVSS score of 5.4. The EPSS score of 0.03% (7th percentile) suggests exploitation is unlikely in practice. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reveals the attack requires authenticated access (PR:L) and produces only limited confidentiality and integrity impact, with no availability impact. CISA's SSVC decision framework indicates no known exploitation, low automatable complexity, and partial technical impact, collectively suggesting this is a targeted, cluster-federation-specific vulnerability requiring significant attacker setup (federated remote cluster compromise or control). The low EPSS percentile contradicts the moderate CVSS, indicating security researchers view real-world risk as minimal despite the theoretical vulnerability.

An organization federated with a partner Mattermost instance experiences a compromise of that remote cluster by an insider attacker. The attacker crafts and sends malicious membership sync messages claiming to add users to a specific shared channel. Due to insufficient scope validation, Mattermost incorrectly grants these users team-level membership to the private team containing that shared channel, granting them access to all channels within that team beyond the intended shared channel scope. The attack requires authenticated access to the remote cluster and knowledge of target team identifiers but does not require user interaction or complex exploitation steps.