EUVD-2026-43308
GHSA-8jmp-2xx6-pjg7
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Webhook management permission (PR:H) is mandatory; network delivery is straightforward (AV:N/AC:L); only integrity is impacted via user impersonation within the application scope.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683
AnalysisAI
Incoming webhook impersonation in Mattermost allows a requester holding webhook management permissions to post content attributed to arbitrary users in teams or channels those users do not belong to. Affected deployments span three active release branches: 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19. No public exploit code exists and the vulnerability is not listed in CISA KEV; the CVSS score of 4.9 correctly reflects that exploitation is constrained by the High privilege requirement, limiting realistic risk to insider threats or compromised privileged accounts.
Technical ContextAI
Mattermost is a widely-deployed open-source team messaging platform used for enterprise collaboration, often as a self-hosted Slack alternative. Incoming webhooks are a core integration feature that allows external systems to post messages into channels by sending HTTP payloads to a unique webhook URL. The vulnerability maps to CWE-639 (Authorization Through User-Controlled Key): when creating or configuring an incoming webhook, the platform accepts a user ID as the attributed author without verifying that the designated user is actually a member of - or has posting rights to - the specified team or channel. Because the authorization check trusts the attacker-controlled identifier rather than enforcing membership, the access control boundary between users and restricted spaces is bypassed entirely. The affected CPE is cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* across the three version branches listed.
RemediationAI
Upgrade to a fixed Mattermost release as specified in the official security advisory at https://mattermost.com/security-updates (MMSA-2026-00683); exact patched version numbers must be confirmed from the advisory directly, as they were not included in the available intelligence. As a compensating control prior to patching, restrict webhook management permissions to the minimum set of trusted administrators using Mattermost's System Console role settings - removing this permission from non-admin roles eliminates the exploitable attack surface at the cost of preventing those users from creating or modifying incoming webhooks. Additionally, audit all existing incoming webhook configurations for entries where the assigned user does not belong to the target team or channel, and revoke or reconfigure any that appear anomalous. Note that revoking webhook management from broad user roles may disrupt legitimate automation and integration workflows, so change management review is advised before applying this control in production.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today