EUVD-2026-43339Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable via standard Mattermost client; requires authenticated session (PR:L); only remote cluster metadata disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-00676
AnalysisAI
Missing authorization in Mattermost's /share-channel slash command autocomplete handler allows any authenticated user to enumerate remote cluster connection metadata, regardless of whether they hold the manage_shared_channels permission. Affects three active release lines (11.7.x, 11.6.x, 10.11.x) and is classified under CWE-862 (Missing Authorization). No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained to authenticated users, limiting realistic blast radius to insider threat or compromised-account scenarios.
Technical ContextAI
Mattermost is a self-hosted and cloud-deployable team messaging platform widely used in enterprise environments. The affected functionality is the slash command autocomplete subsystem, which provides real-time suggestions as a user types a slash command such as /share-channel. This handler is supposed to gate access to autocomplete results for the share-channel command behind the manage_shared_channels permission - a capability that controls who can federate channels with remote Mattermost clusters. CWE-862 (Missing Authorization) indicates that the permission check is entirely absent rather than incorrectly implemented: the handler returns remote cluster connection metadata to any authenticated caller without verifying their privilege level. The CPE string cpe:2.3:a:mattermost:mattermost covers the server component across all affected branches. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the flaw is network-reachable, requires only a standard user session, and results in limited confidentiality loss with no integrity or availability impact.
RemediationAI
Patch available per vendor advisory. Organisations should upgrade to the next patched release in their respective release line as documented in the Mattermost security advisory MMSA-2026-00676 at https://mattermost.com/security-updates; exact fixed version numbers are not stated in the available source data and should be confirmed there before upgrading. If immediate patching is not possible, a compensating control is to restrict the use of the /share-channel command and shared channels feature entirely via Mattermost's System Console by disabling the Shared Channels (federated channels) feature - this removes the vulnerable autocomplete surface but also disables legitimate cross-server channel sharing. Alternatively, access to the Mattermost instance can be restricted so that only explicitly trusted users with business need hold active accounts, reducing the pool of potential exploiters. Both workarounds carry operational trade-offs: disabling shared channels disrupts cross-organisation collaboration workflows.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today