CVEvulnerability

CVE-2026-10085

5.4 MEDIUM Published 2026-07-13 Modified 2026-07-14 Official page ↗
Status
Analyzed
Published
2026-07-13
Last modified
2026-07-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-862

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688

Affected configurations

• mattermost mattermost server (>= 10.11.0 < 10.11.20) • mattermost mattermost server (>= 11.6.0 < 11.6.5) • mattermost mattermost server (>= 11.7.0 < 11.7.3)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References