Improper Access Control in Mattermost Messaging Platform
CVE-2026-9708

4.9MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
13 July 2026

What is CVE-2026-9708?

Mattermost versions 11.7.x up to 11.7.2, 11.6.x up to 11.6.4, and 10.11.x up to 10.11.19 contain a vulnerability where incoming webhook management is not adequately restricted. This flaw allows users with webhook management permissions to exploit the system by configuring webhooks that can create posts or direct messages in teams or channels under the guise of another user. This issue emphasizes the need for enhanced validation processes to control user access to webhooks and prevent unauthorized account impersonation.

Affected Version(s)

Mattermost 11.7.0 <= 11.7.2

Mattermost 11.6.0 <= 11.6.4

Mattermost 10.11.0 <= 10.11.19

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arang
.