CVE-2026-10103CWE-639

Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels

Medium · published July 13, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
14.4
In the wild
Unconfirmed
What it is

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-13T07:57Z
EPSS history
Timeline
  • 13 JUL 07:57Z
    Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
    cvelistv5