Mattermost CVE-2026-4635

A valid low-privilege authenticated Mattermost account is required (confirmed by PR:L in the CVSS vector - unauthenticated or anonymous access cannot trigger this flaw). The race condition activates only during a concurrent channel archival operation: an administrator or authorized user must be actively archiving a channel at the same moment the attacker sends a persistent notification to that channel. The persistent notifications feature must be enabled on the server and accessible to the attacker's account role. Limiting factors include: requirement for authentication (any valid account suffices, but anonymous access is blocked), dependence on concurrent archival activity (infrequent in low-traffic deployments), and precise timing to hit the deletion-to-archival window. Deployments where persistent notifications are disabled or where archival is infrequent face materially lower practical risk than default-configured, high-activity instances.

The CVSS 3.1 score of 6.5 Medium is derived from a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The network attack vector and low complexity indicate the crash is achievable over the network without sophisticated tooling, but PR:L confirms a valid authenticated account is required - ruling out opportunistic anonymous exploitation. The high availability impact (A:H) is consistent with a full server crash rather than degraded performance. No EPSS score was provided in the available data, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public exploit code has been identified. The AC:L rating warrants scrutiny: while the race window is real, reliable triggering likely requires repeated attempts to hit the precise timing between notification deletion and channel archival - AC:L may slightly understate practical reproducibility difficulty. Overall, this is a credible availability risk from malicious insiders or compromised low-privilege accounts rather than a mass-exploitation scenario; confidentiality and integrity are entirely unaffected.

An authenticated low-privilege Mattermost user monitors for administrative channel archival activity - detectable through UI events or API polling. The attacker repeatedly sends persistent notification messages to the targeted channel in rapid succession during the brief window between the server's deletion of existing persistent notifications and completion of the archival operation. When the race condition is hit, the server encounters an inconsistent internal state and crashes, denying service to all users on the instance. No public exploit code has been identified at time of analysis, but the attack is mechanically straightforward for any authenticated user with persistent notification send permissions.