CVE-2026-28759
Remote Cluster Membership Removal in Mattermost
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.14 (exc) |
| mattermost | mattermost_server | From 11.4.0 (inc) to 11.4.4 (exc) |
| mattermost | mattermost_server | From 11.5.0 (inc) to 11.5.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain versions of Mattermost (11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3) where the software fails to properly validate whether a remote cluster has access to a channel before processing requests to remove users from that channel during shared channel membership synchronization.
Because of this failure in validation, a malicious remote cluster can craft membership sync messages that remove any user from any channel, including private channels, even if the remote cluster is not authorized to access those channels.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker controlling a remote cluster to remove users from channels they should not have access to, including private channels.
This unauthorized removal can disrupt communication, cause loss of access to important information, and potentially undermine trust and collaboration within your Mattermost environment.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Mattermost to a version later than the affected versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 where the issue has been fixed.
Stay informed about security updates by subscribing to Mattermost's Security Bulletin and regularly checking their security updates page.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a malicious remote cluster to remove any user from any channel, including private channels, without proper authorization. This unauthorized modification of user access could lead to violations of data protection and privacy requirements mandated by standards such as GDPR and HIPAA, which require strict control over access to sensitive information.
Specifically, the failure to validate access permissions before processing membership removal requests may result in unauthorized data exposure or manipulation, undermining compliance with regulations that mandate safeguarding user data and ensuring proper access controls.