What is the CVSS score of CVE-2026-4635?

CVE-2026-4635 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4635?

Yes, a patch is available for CVE-2026-4635. Update the affected software to the latest version immediately.

Mattermost CVE-2026-4635

Q: Which versions of Mattermost are affected by CVE-2026-4635?

Server crash via race condition in Mattermost's persistent notification and channel archival subsystem allows any low-privileged authenticated user to bring down the server with no user interaction…. A patch is available.

EUVD-2026-31431 MEDIUM

Race Condition (CWE-362)

2026-05-22 Mattermost

GHSA-pg7c-462j-grxv

Denial Of Service Race Condition Mattermost

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel.. Mattermost Advisory ID: MMSA-2026-00637

AnalysisAI

Server crash via race condition in Mattermost's persistent notification and channel archival subsystem allows any low-privileged authenticated user to bring down the server with no user interaction required. Affected branches span 10.11.x through 11.6.x across multiple maintenance lines. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the low authentication bar combined with network accessibility and low attack complexity makes this a credible insider threat or targeted denial-of-service vector against any exposed Mattermost deployment.

Technical ContextAI

The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization - Race Condition) within Mattermost's channel lifecycle management. When a channel is archived, the server performs two sequential operations: first deleting existing persistent notifications, then marking the channel as archived. The implementation fails to atomically protect this two-step sequence, leaving a race window during which an authenticated user can inject a new persistent notification message. The server subsequently encounters an inconsistent state - a notification exists for a channel in mid-archival - and crashes. The affected product is confirmed via CPE cpe:2.3:a:mattermost:mattermost across the 10.11.x, 11.4.x, 11.5.x, and 11.6.x release lines, all of which share the flawed archival logic. The persistent notifications feature is the specific attack surface; without it, the race window does not exist.

RemediationAI

Upgrade Mattermost to a patched release as specified in vendor advisory MMSA-2026-00637, available at https://mattermost.com/security-updates. Exact fixed version numbers are not independently confirmed from the provided input data beyond the stated affected ranges - administrators must consult the advisory directly to identify the correct target upgrade version for their branch. If immediate patching is not operationally feasible, disable or restrict access to the persistent notifications feature for non-administrative roles; this eliminates the attacker's ability to inject a notification during the archival race window, though it removes persistent notification functionality for those users. Additionally, restricting channel archival permissions to a minimal set of trusted administrators reduces the frequency of archival events and therefore the practical opportunity for race condition exploitation. Neither workaround is a substitute for patching.