GitHub Advisoryadvisory · Go

GHSA-v549-xx3c-6pc8 Mattermost doesn't check the create_post channel permission during post edit operations

MEDIUM Published 2026-05-18 Modified 2026-06-01 Official page ↗
Aliases
CVE-2026-3637
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862
Reviewed
2026-06-01

Affected packages

• Go github.com/mattermost/mattermost/server/v8: >= 10.11.0, < 10.11.14 → fixed in 10.11.14 • Go github.com/mattermost/mattermost/server/v8: >= 11.4.0, < 11.4.4 → fixed in 11.4.4 • Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260316171743-090408f09f53 → fixed in 8.0.0-20260316171743-090408f09f53 • Go github.com/mattermost/mattermost/server/v8: >= 11.5.0, < 11.5.2 → fixed in 11.5.2 • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260316171743-090408f09f53 → fixed in 5.3.2-0.20260316171743-090408f09f53

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

Related

Alias · CVE (1)

  • CVE-2026-3637 Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References