CVE-2026-3637

Analyzed Analyzed - Analysis Complete

Mattermost Post Edit Permission Bypass via API

Publication date: 2026-05-18

Last updated on: 2026-05-19

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-18

Last Modified

2026-05-19

Generated

2026-06-30

AI Q&A

2026-05-18

EPSS Evaluated

2026-06-28

NVD

CVE-2026-3637

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.14 (exc)
mattermost	mattermost_server	From 11.4.0 (inc) to 11.4.4 (exc)
mattermost	mattermost_server	From 11.5.0 (inc) to 11.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects certain versions of Mattermost (11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3) where the system fails to check the create_post channel permission during post edit operations.

As a result, an authenticated attacker whose posting privileges have been revoked can still modify their existing posts by sending direct API requests to the post update and patch endpoints.

Impact Analysis

This vulnerability allows an attacker who no longer has permission to create posts to still edit their existing posts.

This could lead to unauthorized modification of content within channels, potentially undermining trust, causing misinformation, or bypassing moderation controls.

Detection Guidance

This vulnerability involves Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 where the create_post channel permission is not checked during post edit operations. Detection would involve identifying if your Mattermost instance is running one of these affected versions.

To detect exploitation attempts on your network or system, you can monitor API requests to the post update and patch endpoints, especially those made by authenticated users whose posting privileges have been revoked.

Specific commands are not provided in the available resources or CVE description.

Mitigation Strategies

Immediate mitigation steps include upgrading your Mattermost installation to a version later than 11.5.1, 10.11.13, or 11.4.3 where this issue is fixed.

Additionally, review and restrict API access to the post update and patch endpoints to prevent unauthorized post modifications.

Monitor Mattermost Security Updates for official patches and advisories.

Hi! I’m here to help you understand CVE-2026-3637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70