Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 11.7.0 – ≤ 11.7.2, 11.6.0 – ≤ 11.6.4, 10.11.0 – ≤ 10.11.19 | 11.8.0 |
Advisories 1
- WID-SEC-2026-1932 Mattermost: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Jul 13, 2026
References
- MMSA-2026-00689 vendor-advisory