CVE-2026-10106
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A vulnerability in Mattermost allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel. The issue stems from a failure to verify that the channel referenced in an action cookie matches the channel of the target post.
Risk Assessment
The organization is at risk of unauthorized execution of actions on posts in private channels by users who should not have access. This could lead to information disclosure or content manipulation in confidential channels.
Recommendation
Immediately upgrade Mattermost to version 11.7.3, 11.6.5, 10.11.20 or later, as recommended by the vendor.
Other vulnerabilities in Mattermost
See all- CVE-2026-9693Low
Mattermost versions 10.11.x <= 10.11.20 and 11.7.x <= 11.7.5 fail to remove thread membership records when a user is removed from or leaves a team, allowing a previously removed user who is later re-invited to view private channel thread root post content and metadata via the team threads API.
- CVE-2026-9859Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request.
- CVE-2026-9816High
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths, allowing a board editor or non-guest team member to grant board admin to arbitrary users.
- CVE-2026-10080Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate WebSocket command field types, allowing an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.
- CVE-2026-16048Medium
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles, which allows a channel administrator to gain additional channel permissions via the channel member roles API.
- CVE-2026-16047Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing, or bulk-creating boards with an arbitrary channelId.
- CVE-2026-16046Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs, which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests.
- CVE-2026-16045Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other integrations via account-management endpoints.
- CVE-2026-16044Medium
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import, which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file.
- CVE-2026-15754Medium
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 fail to re-validate that each target channel still belongs to the requesting admin's team when calling the policy unassign endpoint. This allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team after a channel has been moved to another team.
Original NVD description (English source)
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel via a cookie obtained from any accessible channel.. Mattermost Advisory ID: MMSA-2026-00690