GitHub Advisoryadvisory · Go

GHSA-hw87-6jcq-9f8q Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields

LOW Published 2026-05-15 Modified 2026-05-28 Official page ↗
Aliases
CVE-2026-4053
Ecosystem
Go
Packages
github.com/mattermost/mattermost-server
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-672
Reviewed
2026-05-28

Affected packages

• Go github.com/mattermost/mattermost-server: >= 11.5.0, < 11.5.2 → fixed in 11.5.2 • Go github.com/mattermost/mattermost-server: >= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e → fixed in 0.0.0-20260414103857-b21ef302025e

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints. Mattermost Advisory ID: MMSA-2026-00631.

Related

Alias · CVE (1)

  • CVE-2026-4053 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an… vulnerability

Weakness · CWE (1)

  • CWE-672 Operation on a Resource after Expiration or Release weakness

References