What is the CVSS score of CVE-2026-6062?

CVE-2026-6062 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-6062

EUVD-2026-38250 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-22 Mattermost

GHSA-mxq2-5jpg-7474

Mattermost Authentication Bypass

6.4

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

5.9 MEDIUM

Subscription hijacking requires authenticated access (PR:L) and knowledge of a target subscription ID (AC:H); no clear availability impact beyond confidentiality and integrity of subscription data.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 14:41 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650

AnalysisAI

Subscription hijacking in Mattermost allows authenticated low-privileged users to take control of subscriptions belonging to channels they have no access to by submitting a crafted PUT request to the subscription edit endpoint. The root cause is a missing channel ownership validation check, classified as an Insecure Direct Object Reference (CWE-639), affecting versions across four active release branches (10.11.x, 11.5.x, 11.6.x, 11.7.x). No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Mattermost is an open-source team messaging platform. Its subscription system allows users or integrations to subscribe to channel activity for notifications or data relay. The affected endpoint (PUT /subscriptions/{id}) performs an edit operation on a subscription record identified by a user-supplied ID. CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly this failure: the server accepts a caller-controlled subscription identifier and applies the edit without verifying that the subscription belongs to a channel the requesting user is authorized to access. This is a classic IDOR pattern. The CPE cpe:2.3:a:mattermost:mattermost covers all deployment forms of the platform. The CVSS vector AC:H reflects that exploitation requires the attacker to possess or enumerate a valid subscription ID belonging to a channel outside their access scope.

RemediationAI

Upgrade to a fixed version per Mattermost advisory MMSA-2026-00650, available at https://mattermost.com/security-updates. Specific patched release version numbers are not explicitly stated in the available advisory reference - only affected version ceilings are confirmed; administrators should consult the security updates page directly to identify the exact remediated release for their branch. As a compensating control while upgrade is pending, restrict access to the Mattermost instance to trusted authenticated users only (reduce attack surface by tightening who can register or hold accounts), and audit subscription configurations on sensitive private channels for unexpected modifications. Disabling external webhook subscription features, if not operationally required, reduces the attack surface at the cost of losing subscription-based integrations.