Mattermost CVE-2026-93847

Requires an authenticated Mattermost account that is already a member of the target channel, and use of the scheduled post creation/publication endpoint on affected versions 11.7.x <= 11.7.10. The concrete prerequisite is the ability to submit a scheduled post specifying a reserved system post type, which the vulnerable paths fail to validate. Exploitation is limited by: the attacker needing valid credentials and channel membership (not anonymous/remote-unauthenticated), the impact being confined to message spoofing (no data disclosure or system compromise), and the deception only succeeding when other members view and trust the forged system-style message. Only the 11.7.x branch at or below 11.7.10 is indicated as affected.

This is a low-severity, low-priority issue and the signals are internally consistent. The CVSS 3.1 base score is 3.5 (Low) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N: network-reachable but requiring an authenticated account that is already a member of the target channel (PR:L), with only a limited integrity impact (I:L) and no confidentiality or availability impact. The vuln.today decision label is 'monitor', the lowest urgency tier, which aligns with the low CVSS. There is no CISA KEV listing, no EPSS probability supplied, and no PoC or exploit reference in the input, so exploitation status is 'no public exploit identified at time of analysis'. CWE-863 (Improper Authorization) matches the described defect: the scheduled-post paths fail to reject reserved system post types, letting an ordinary channel member publish content that renders with the visual authority of trusted system events - effectively a message-spoofing/social-engineering primitive rather than a data-compromise or code-execution flaw. The real-world risk is therefore modest: the worst outcome is deceiving other channel members into trusting a forged 'system' message, which requires a victim to read it. No key signals conflict; the main gap is that EPSS and any exploitation-maturity data are absent, so probability of exploitation cannot be quantified from the input.

An attacker who already holds a valid Mattermost account and is a member of a target channel crafts a scheduled post that specifies a reserved system post type. When the post is created and later published, it renders to other members as a trusted system-generated event (e.g., a join/leave or administrative notice) rather than as an ordinary user message, enabling convincing in-channel social engineering. No public exploit code is identified at time of analysis; realistic exploitation also depends on a victim reading and trusting the forged system message.