Mattermost CVE-2026-93851

Exploitation requires the attacker to be an authenticated Mattermost user able to post in a channel that is visible to a system administrator, and it specifically targets the Agents plugin's mention reminder component, which fails to validate the target post ID. The attack only succeeds if a system administrator subsequently clicks the attacker's crafted post containing the forged mention reminder (UI:R) - so it depends on privileged user interaction rather than default remote exploitation. Limiting factors: the victim must hold administrator privileges whose browser session authorizes plugin installation/replacement, the attacker must already have post access in a shared channel (PR:L), and the attacker cannot control the timing of the admin's click (reflected in AC:H). This is not exploitable against a default configuration without a privileged victim action.

This is a genuine priority rather than a CVSS-inflated non-issue, though its exploitation path is narrow. The vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) encodes the real mechanics well: an authenticated low-privilege user (PR:L) crafts a forged mention reminder, but exploitation hinges on a system administrator seeing and clicking it (UI:R), which also drives the high attack complexity (AC:H) because the attacker does not control when or whether a privileged victim acts. The payoff is severe - scope change (S:C) from the admin's browser to the server, yielding plugin replacement and full code execution (C:H/I:H/A:H). On the decision signals: vuln.today assigns 'this_week', not act_now/emergency, consistent with the absence of corroborating exploitation data. EPSS is not provided in the input, the CVE is not in CISA KEV, and the only reference is the vendor advisory with no public proof-of-concept - so there is no evidence of active exploitation or available exploit code. The CWE is labeled CWE-22 (Path Traversal), yet the description describes a cross-site-request-forgery-style flow (unvalidated target post ID causing the admin browser to issue an unintended API request); this is a mild classification tension worth noting but not a contradiction, since the server-side plugin replacement can plausibly involve a traversal primitive. Net: high technical impact gated by a social/privileged-click precondition - patch this week as the vendor priority indicates, but it is not a drive-by mass-exploitation scenario.

A low-privileged but authenticated Mattermost user posts a crafted message containing a forged mention reminder in a channel that a system administrator can see. When the administrator clicks the reminder, their authenticated browser is coerced into sending an unintended API request that replaces an installed plugin, resulting in code execution on the Mattermost server. No public exploit code is identified in the available sources, and success depends on an administrator actually viewing and clicking the malicious post.