Insecure Cookie Management Flaw in Mattermost by Mattermost
CVE-2026-10106

6.5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
13 July 2026

What is CVE-2026-10106?

Mattermost versions 11.7.2 and earlier, 11.6.4 and earlier, and 10.11.19 and earlier have a vulnerability where the system fails to validate that the channel referenced in an action cookie corresponds with the actual target post's channel. This oversight allows authenticated users without proper permissions to initiate interactive actions on posts within private channels, leveraging cookies from other accessible channels. This could lead to unauthorized access and potentially compromise sensitive data within the private channels.

Affected Version(s)

Mattermost 11.7.0 <= 11.7.2

Mattermost 11.6.0 <= 11.6.4

Mattermost 10.11.0 <= 10.11.19

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

minghseinyuc86595
.