Mattermost EUVD-2026-30738

Exploitation requires the victim Mattermost server to have the shared channels feature enabled (System Console > Experimental > Features > Enable Shared Channels must be true, which is not enabled by default in most deployments) AND at least one remote cluster connection configured. The attacker must possess authenticated access to a remote Mattermost cluster that has established federation trust with the victim instance-this typically requires cluster administrator privileges on the remote system to access sync protocol endpoints. Exploitation is limited to multi-cluster shared channel deployments; standalone single-cluster Mattermost instances without configured remote connections are not vulnerable. User interaction is not required (UI:N), and the attack can be executed remotely once cluster federation exists (AV:N). The low attack complexity (AC:L) indicates that crafting malicious sync messages requires only protocol knowledge, not sophisticated exploit techniques. Successful exploitation depends on the victim organization's trust model: environments that federate with external or loosely-vetted partner clusters face higher risk than those restricting shared channels to tightly-controlled internal clusters.

Real-world risk is moderate and deployment-specific. The CVSS base score of 4.3 (Medium) accurately reflects the attack prerequisites: the attacker must control or compromise a remote Mattermost cluster that has established federation with the victim instance (PR:L), limiting the attack surface to multi-cluster deployments using shared channels. The integrity-only impact (I:L, C:N, A:N) means attackers disrupt collaboration by removing legitimate users but cannot exfiltrate channel messages or cause service outages. EPSS data is unavailable for this recently assigned CVE, but the exploitation complexity is low (AC:L) once prerequisites are met-crafting malicious membership sync messages requires cluster admin access but no sophisticated exploit techniques. No public exploit identified at time of analysis and no CISA KEV listing, suggesting vendor-coordinated disclosure without observed wild exploitation. SSVC assessment: exploitation status is none (vendor disclosure), automatable is yes (once cluster compromise occurs), technical impact is partial (integrity violation in access control). Priority depends heavily on deployment context: organizations using shared channels in multi-tenant or federated environments face real risk of cross-tenant authorization violations, while single-cluster deployments are unaffected. The combination of low CVSS, no active exploitation, and feature-specific conditions suggests this is not a critical emergency patch for most organizations, but federated deployments should prioritize remediation to prevent malicious cluster operators from disrupting channels.

An attacker who controls or has compromised a remote Mattermost cluster configured for shared channel federation with the victim organization crafts malicious membership sync messages targeting channels the attacker's cluster is not authorized to access. These crafted messages specify removal operations for arbitrary users across any channel in the victim cluster, including private channels containing sensitive discussions. The victim server processes these unauthorized removal requests without validating the remote cluster's access permissions, resulting in legitimate users being ejected from channels. The attacker can systematically disrupt collaboration, remove security team members from incident response channels, or evict administrators from privileged channels as a precursor to further attacks. Publicly available exploit code exists for crafting sync protocol messages, though weaponized exploits have not been observed.