CVE-2026-28759

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://mattermost.com/security-updates	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Mattermost 11.5.x hasta 11.5.1, 10.11.x hasta 10.11.13, 11.4.x hasta 11.4.3 fallan al validar que un clúster remoto tiene acceso a un canal antes de procesar las solicitudes de eliminación de membresía durante la sincronización de membresía de canales compartidos, lo que permite a un clúster remoto malicioso eliminar a cualquier usuario de cualquier canal, incluyendo canales privados, a través de mensajes de sincronización de membresía manipulados dirigidos a canales a los que el clúster remoto no está autorizado a acceder. ID de Aviso de Mattermost: MMSA-2026-00576

Information

Published : 2026-05-18 08:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-28759

Mitre link : CVE-2026-28759

CVE.ORG link : CVE-2026-28759

JSON object : View

Products Affected

mattermost

mattermost_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-28759", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28759", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T14:35:53.724940Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "responsibledisclosure@mattermost.com", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "versions": [{"status": "affected", "version": "11.5.0", "versionType": "semver", "lessThanOrEqual": "11.5.1"}, {"status": "affected", "version": "10.11.0", "versionType": "semver", "lessThanOrEqual": "10.11.13"}, {"status": "affected", "version": "11.4.0", "versionType": "semver", "lessThanOrEqual": "11.4.3"}, {"status": "unaffected", "version": "11.6.0"}, {"status": "unaffected", "version": "11.5.2"}, {"status": "unaffected", "version": "10.11.14"}, {"status": "unaffected", "version": "11.4.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-18T08:16:13.573", "references": [{"url": "https://mattermost.com/security-updates", "tags": ["Vendor Advisory"], "source": "responsibledisclosure@mattermost.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "responsibledisclosure@mattermost.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576"}, {"lang": "es", "value": "Las versiones de Mattermost 11.5.x hasta 11.5.1, 10.11.x hasta 10.11.13, 11.4.x hasta 11.4.3 fallan al validar que un cl\u00faster remoto tiene acceso a un canal antes de procesar las solicitudes de eliminaci\u00f3n de membres\u00eda durante la sincronizaci\u00f3n de membres\u00eda de canales compartidos, lo que permite a un cl\u00faster remoto malicioso eliminar a cualquier usuario de cualquier canal, incluyendo canales privados, a trav\u00e9s de mensajes de sincronizaci\u00f3n de membres\u00eda manipulados dirigidos a canales a los que el cl\u00faster remoto no est\u00e1 autorizado a acceder. ID de Aviso de Mattermost: MMSA-2026-00576"}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "413D9405-79C3-4299-B0DC-40D9EE5CC717", "versionEndExcluding": "10.11.14", "versionStartIncluding": "10.11.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF171039-837A-4D23-87EB-F328AD04976C", "versionEndExcluding": "11.4.4", "versionStartIncluding": "11.4.0"}, {"criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "726AD6AD-6C01-45BB-9115-B8209717A6D4", "versionEndExcluding": "11.5.2", "versionStartIncluding": "11.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "responsibledisclosure@mattermost.com"}