CVE-2026-3637
Mattermost Post Edit Permission Bypass via API
Publication date: 2026-05-18
Last updated on: 2026-05-19
Assigner: Mattermost, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mattermost | mattermost_server | From 10.11.0 (inc) to 10.11.14 (exc) |
| mattermost | mattermost_server | From 11.4.0 (inc) to 11.4.4 (exc) |
| mattermost | mattermost_server | From 11.5.0 (inc) to 11.5.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects certain versions of Mattermost (11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3) where the system fails to check the create_post channel permission during post edit operations.
As a result, an authenticated attacker whose posting privileges have been revoked can still modify their existing posts by sending direct API requests to the post update and patch endpoints.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 where the create_post channel permission is not checked during post edit operations. Detection would involve identifying if your Mattermost instance is running one of these affected versions.
To detect exploitation attempts on your network or system, you can monitor API requests to the post update and patch endpoints, especially those made by authenticated users whose posting privileges have been revoked.
Specific commands are not provided in the available resources or CVE description.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading your Mattermost installation to a version later than 11.5.1, 10.11.13, or 11.4.3 where this issue is fixed.
Additionally, review and restrict API access to the post update and patch endpoints to prevent unauthorized post modifications.
Monitor Mattermost Security Updates for official patches and advisories.
How can this vulnerability impact me? :
This vulnerability allows an attacker who no longer has permission to create posts to still edit their existing posts.
This could lead to unauthorized modification of content within channels, potentially undermining trust, causing misinformation, or bypassing moderation controls.