Mattermost Channel Participant Removal via API

Executive Summary

This vulnerability exists in Mattermost versions 11.7.x up to 11.7.2, 11.6.x up to 11.6.4, and 10.11.x up to 10.11.19. It occurs because the software fails to restrict the group_constrained channel flag to only public and private channels that support group synchronization. As a result, an ordinary group or direct message member can exploit this flaw via the channel patch API to remove all participants from a conversation.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the installed version of Mattermost on your system. The vulnerability affects specific versions: 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19.

• Check the Mattermost server version by running the following command if you have access to the server: curl -i http://<your-mattermost-server>/api/v4/system/ping. Look for the 'version' field in the response.
• Alternatively, log in to the Mattermost web interface, click on the product menu (three dots) in the top-left corner, and select 'About Mattermost' to view the version.

If your Mattermost version falls within the affected ranges, your system may be vulnerable. No specific network detection commands are provided for this vulnerability, as it is primarily a logic flaw in the application.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an ordinary group or direct message member to remove all participants from a conversation. This can disrupt communication within the affected channels, potentially causing denial of service for legitimate users and impacting collaboration and information flow.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Mattermost (CVE-2026-10085) could impact compliance with standards and regulations like GDPR and HIPAA due to its potential to allow unauthorized removal of participants from conversations. This may lead to data integrity issues or unauthorized access to sensitive communications.

Under GDPR, this vulnerability could result in non-compliance if it leads to unauthorized access or manipulation of personal data, as GDPR requires strict controls over data integrity and access. Similarly, HIPAA mandates safeguards for protected health information (PHI), and unauthorized participant removal could disrupt secure communication channels handling PHI.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) indicates low confidentiality impact but low integrity and availability impacts, which may still pose risks to regulatory compliance if sensitive data or communication integrity is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Mattermost to the latest patched version. Refer to the official Mattermost security updates page for the fixed versions.
• If upgrading is not immediately possible, restrict access to the Mattermost API for non-administrative users until the patch is applied.
• Monitor Mattermost logs for unusual activity, such as unauthorized modifications to channel participants via the channel patch API.

For further guidance, consult the Mattermost security advisory (MMSA-2026-00688) or the security updates page linked in the resources.

Useful 0 Not Useful 0