VULNERABILITY INTELLIGENCE

CVE-2026-10103

CVSS score4.3 MEDIUM
EPSS probability0.24%
CISA KEVNot currently listed
Published2026-07-13
Last modified2026-07-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-639

Primary references