CVE-2026-10103
Received Received - Intake

Mattermost Post Ownership Bypass in Shared Channels

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-10103
EUVD
EUVD-2026-43307

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.7.2 (inc)
mattermost mattermost to 11.6.4 (inc)
mattermost mattermost to 10.11.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost (11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19) where the system fails to verify post ownership in the shared channel inbound sync handler.

Because of this failure, an authenticated remote cluster can modify or delete posts authored by local users or other remote clusters by sending crafted sync messages that reference arbitrary post IDs in channels shared with that remote cluster.

Impact Analysis

The vulnerability allows an authenticated remote cluster to alter or remove posts created by local users or other remote clusters in shared channels.

This can lead to unauthorized modification or deletion of content, potentially disrupting communication and collaboration within the affected Mattermost channels.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart