What is the CVSS score of EUVD-2026-30753?

EUVD-2026-30753 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-30753?

Yes, a patch is available for EUVD-2026-30753. Update the affected software to the latest version immediately.

Mattermost EUVD-2026-30753

Q: Which versions of Mattermost are affected by EUVD-2026-30753?

Authenticated Mattermost users can read private channel threads and direct messages they lack access to by exploiting the AI post rewrite endpoint.. A patch is available.

| CVE-2026-5163 MEDIUM

Missing Authorization (CWE-862)

2026-05-18 Mattermost

GHSA-8r89-8w26-cq32

Mattermost Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 09:32 vuln.today

DescriptionCVE.org

Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645

AnalysisAI

Authenticated Mattermost users can read private channel threads and direct messages they lack access to by exploiting the AI post rewrite endpoint. Versions 11.5.0 and 11.5.1 fail to verify channel membership before processing AI-assisted message rewrites, enabling privilege escalation from low-privileged authenticated users to access confidential communications. CVSS 6.5 reflects network-accessible attack with low complexity requiring only basic authentication. EPSS data not available; no public exploit or KEV listing identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization) in Mattermost's AI-assisted message rewrite feature, introduced in version 11.5.x. The post rewrite endpoint processes user requests to modify message content using AI assistance but fails to validate whether the requesting user has membership or read permissions for the channel containing the target thread. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-accessible API endpoint with no rate limiting or additional security controls beyond basic authentication. Mattermost's access control model relies on explicit channel membership grants, particularly for private channels and direct messages which contain sensitive organizational communications. The authorization bypass occurs server-side during API request processing, allowing any authenticated user to craft requests referencing post IDs from channels they cannot normally view.

RemediationAI

Upgrade immediately to Mattermost version 11.5.2 or later which addresses the missing authorization check in the AI post rewrite endpoint per vendor advisory MMSA-2026-00645 at https://mattermost.com/security-updates. If immediate patching is not feasible, disable the AI-assisted message rewrite feature through Mattermost system console under AI settings, which eliminates the vulnerable attack surface but removes functionality users may rely on for productivity. Alternatively, implement network-level access controls restricting API endpoint access to trusted IP ranges, though this does not mitigate insider threats from authenticated users within the network perimeter. Review access logs for unusual POST requests to rewrite endpoints referencing post IDs from channels the requesting user does not belong to, filtering for HTTP 200 responses that should have returned 403 Forbidden errors. Audit private channel memberships and direct message participant lists to identify potential unauthorized access during the vulnerability window between 11.5.0 release and patching.