What is the CVSS score of EUVD-2026-30586?

EUVD-2026-30586 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30586?

Yes, a patch is available for EUVD-2026-30586. Update the affected software to the latest version immediately.

Mattermost EUVD-2026-30586

Q: Which versions of Mattermost are affected by EUVD-2026-30586?

Authenticated users in Mattermost 11.5.x through 11.5.1 and 10.11.x through 10.11.13 can modify post attachments, properties, and pin status beyond the configured edit time window.. A patch is available.

| CVE-2026-4053 LOW

Operation on a Resource after Expiration or Release (CWE-672)

2026-05-15 Mattermost

GHSA-hw87-6jcq-9f8q

Information Disclosure Mattermost

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 19:33 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

AnalysisAI

Authenticated users in Mattermost 11.5.x through 11.5.1 and 10.11.x through 10.11.13 can modify post attachments, properties, and pin status beyond the configured edit time window. The vulnerability bypasses the PostEditTimeLimit control via patch and update API endpoints, allowing indefinite modification of non-message post metadata after the intended edit window expires. CVSS 3.1 (Low) reflects network vector with high complexity and low-privilege requirements, while no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

Mattermost is an open-source collaboration platform. The PostEditTimeLimit setting enforces a time window during which users can edit their posts, typically used to prevent tampering with historical conversation context. This vulnerability affects the API enforcement layer (CWE-672: Operation on a Resource after Expiration or Release) where the patch and update endpoints fail to apply PostEditTimeLimit validation to non-message fields including file attachments, custom props objects, and pinned status flags. The affected CPE confirms impact across both the 11.5.x stable branch (versions up to 11.5.1) and the 10.11.x long-term support branch (versions up to 10.11.13). The CVSS vector AV:N/AC:H/PR:L indicates network-accessible exploitation requiring low-privilege authenticated access with some complexity factors, likely related to API endpoint knowledge or timing considerations.

RemediationAI

Upgrade to Mattermost version 11.5.2 or later for the stable branch, or 10.11.14 or later for the LTS branch, per vendor advisory MMSA-2026-00631 at https://mattermost.com/security-updates. If immediate patching is not feasible, implement API-level access controls to restrict use of the post patch and update endpoints to administrative roles only, though this significantly degrades normal editing functionality and may break workflows. Monitor API logs for unusual patterns of post metadata modifications occurring outside expected edit windows, particularly changes to file attachments or pin status on older posts. Consider temporarily reducing PostEditTimeLimit to zero (disable all editing) in high-sensitivity channels until patches are applied, accepting the usability trade-off of requiring message deletion and reposting for corrections. Note that no effective compensating control fully mitigates the vulnerability without impacting legitimate editing capabilities.