Server-Side Check Bypass in Mattermost Messaging Software
CVE-2026-18795

6.4MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 October 2026

What is CVE-2026-18795?

Mattermost messaging software versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5 are affected by a vulnerability that fails to enforce direct message and group message checks on the server side. This oversight allows authenticated users to quarantine posts intended for direct or group messaging through direct API calls, potentially leading to unauthorized content management and exploitation within the platform.

Affected Version(s)

Mattermost 11.10.0

Mattermost 11.7.0 <= 11.7.9

Mattermost 11.9.0 <= 11.9.1

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Harshil Sharma
.