Mattermost EUVD-2026-102813

Exploitation requires an authenticated Mattermost account (PR:L) and the ability to issue a direct API call to the post-quarantine functionality, bypassing the missing server-side DM/GM membership check. The affected versions are specifically Mattermost 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.9 - deployments on fixed point releases are not exploitable. Limiting factors: the attacker must already hold valid credentials on the target instance, the CVSS AC:H rating indicates non-trivial conditions must be met to reliably trigger the flaw, and the impact is confined to improperly quarantining DM/GM posts rather than full data compromise.

This is a moderate-severity authorization flaw (CVSS 6.4) that is a genuine but low-urgency priority rather than an emergency. The CVSS vector (AV:N/AC:H/PR:L/UI:N) confirms a network-reachable issue requiring an already-authenticated user (PR:L) and some elevated attack complexity (AC:H), with no user interaction. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or widespread automated attacks. The CWE-862 (Missing Authorization) classification aligns with the description of a server-side DM/GM check failure. One signal to verify: the vendor's vector assigns C:H (high confidentiality impact), but the described action is 'quarantining' a post (a moderation/state-change action), which reads more like an integrity/availability effect than a confidentiality breach - the C:H rating is not obviously justified by the description and should be verified with Mattermost. Overall: a real but contained insider/authenticated-abuse issue, not a mass-exploitation threat.

An authenticated Mattermost user who already has valid credentials crafts a direct API call to the post-quarantine endpoint, bypassing the server-side check that should restrict the action to posts the user is authorized over. Because the DM/GM membership check is only enforced client-side or not at all, the attacker can quarantine posts belonging to direct messages or group messages they should not control. No public exploit code was identified, so exploitation currently requires an attacker to manually construct the API request.