CVE-2026-28759
Received Received - Intake

Remote Cluster Membership Removal in Mattermost

Publication date: 2026-05-18

Last updated on: 2026-05-18

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-18
Last Modified
2026-05-18
Generated
2026-06-30
AI Q&A
2026-05-18
EPSS Evaluated
2026-06-28
NVD
CVE-2026-28759

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost_server From 10.11.0 (inc) to 10.11.14 (exc)
mattermost mattermost_server From 11.4.0 (inc) to 11.4.4 (exc)
mattermost mattermost_server From 11.5.0 (inc) to 11.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost (11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3) where the software fails to properly validate whether a remote cluster has access to a channel before processing requests to remove users from that channel during shared channel membership synchronization.

Because of this failure in validation, a malicious remote cluster can craft membership sync messages that remove any user from any channel, including private channels, even if the remote cluster is not authorized to access those channels.

Impact Analysis

This vulnerability can impact you by allowing an attacker controlling a remote cluster to remove users from channels they should not have access to, including private channels.

This unauthorized removal can disrupt communication, cause loss of access to important information, and potentially undermine trust and collaboration within your Mattermost environment.

Mitigation Strategies

To mitigate this vulnerability, you should update Mattermost to a version later than the affected versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 where the issue has been fixed.

Stay informed about security updates by subscribing to Mattermost's Security Bulletin and regularly checking their security updates page.

Compliance Impact

The vulnerability allows a malicious remote cluster to remove any user from any channel, including private channels, without proper authorization. This unauthorized modification of user access could lead to violations of data protection and privacy requirements mandated by standards such as GDPR and HIPAA, which require strict control over access to sensitive information.

Specifically, the failure to validate access permissions before processing membership removal requests may result in unauthorized data exposure or manipulation, undermining compliance with regulations that mandate safeguarding user data and ensuring proper access controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart