CVE-2026-18795
Awaiting Analysis Awaiting Analysis - Queue

Mattermost DM/GM Post Quarantine Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-18795
EUVD
EUVD-2026-102813

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.9 and 11.10.0 have a flaw where server-side checks for direct messages (DM) or group messages (GM) are not properly enforced. This allows an authenticated user to quarantine a post in a DM or GM through a direct API call, bypassing intended restrictions.

Detection Guidance

This vulnerability involves unauthorized quarantine of DM/GM posts via API calls. To detect it, monitor Mattermost server logs for unusual API calls targeting DM/GM posts, especially from non-admin users. Check for POST requests to /api/v4/posts/{post_id}/quarantine with user IDs not matching the post's channel participants.

Impact Analysis

An attacker with valid credentials could misuse this flaw to quarantine or disrupt legitimate conversations in private DMs or GMs. This could lead to loss of critical communications, data integrity issues, or unauthorized content restriction within the platform.

Compliance Impact

The vulnerability allows an authenticated user to quarantine posts in direct messages or group messages via API calls, potentially enabling unauthorized access or modification of sensitive communications. This could violate data protection requirements under GDPR (e.g., integrity and confidentiality of personal data) and HIPAA (e.g., safeguarding protected health information) by exposing or altering private communications.

Mitigation Strategies

Upgrade Mattermost to a version that is not affected by this vulnerability. Specifically, update to a version beyond 11.10.0, 11.7.9, 11.9.1, or 11.8.5 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart