CVE-2026-3637CWE-862broken-access-control

CVE-2026-3637

Medium · published May 18, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-18T12:16Z
Affected products (3)
ProductVersionsFixed in
mattermost/mattermost_server≥ 10.11.0, < 10.11.1410.11.14
mattermost/mattermost_server≥ 11.4.0, < 11.4.411.4.4
mattermost/mattermost_server≥ 11.5.0, < 11.5.211.5.2
References (1)
https://mattermost.com/security-updates · [email protected]
EPSS history
Timeline
  • 18 MAY 06:53Z
    Mattermost fails to enforce create_post permission when editing posts
    cvelistv5