CVE-2026-3637

MEDIUM

Mattermost fails to enforce create_post permission when editing posts

Title source: cna
STIX 2.1

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
MMSA-2026-00627
https://mattermost.com/security-updates

Scores

CVSS v3 4.3
EPSS 0.0015
EPSS Percentile 4.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (13)
mattermost/mattermost 0 - 8.0.0-20260316171743-090408f09f53Go
Mattermost/Mattermost 10.11.0 - 10.11.13
mattermost/mattermost 10.11.0 - 10.11.14Go
Mattermost/Mattermost 10.11.14
Mattermost/Mattermost 11.4.0 - 11.4.3
mattermost/mattermost 11.4.0 - 11.4.4Go
Mattermost/Mattermost 11.4.4
Mattermost/Mattermost 11.5.0 - 11.5.1
mattermost/mattermost 11.5.0 - 11.5.2Go
Mattermost/Mattermost 11.5.2
... and 3 more
Published May 18, 2026
Tracked Since May 18, 2026