CVE-2026-93847
Awaiting Analysis Awaiting Analysis - Queue

Scheduled Post Spoofing in Mattermost

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-93847
EUVD
EUVD-2026-109934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mattermost Mattermost 11.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.0 and 11.7.10 do not properly check reserved system post types when creating or publishing scheduled posts. This allows an authenticated user with channel access to publish messages that appear as trusted system events through the scheduled post feature.

Impact Analysis

An attacker with channel membership could exploit this to send misleading system-like messages, potentially tricking users into taking harmful actions or believing false system notifications.

Mitigation Strategies

Upgrade Mattermost to a version higher than 11.7.10 to address the vulnerability in scheduled post creation and publication paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart