CVE-2026-10106
Received Received - Intake

Authentication Bypass in Mattermost via Action Cookie Manipulation

Publication date: 2026-07-13

Last updated on: 2026-07-13

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in that channel via a cookie obtained from any accessible channel.. Mattermost Advisory ID: MMSA-2026-00690

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-13
Last Modified
2026-07-13
Generated
2026-07-13
AI Q&A
2026-07-13
EPSS Evaluated
N/A
NVD
CVE-2026-10106
EUVD
EUVD-2026-43312

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.7.2 (inc)
mattermost mattermost to 11.6.4 (inc)
mattermost mattermost to 10.11.19 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost (11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19) where the software fails to verify that the channel referenced in an action cookie matches the channel of the target post.

Because of this failure, an authenticated user who does not have access to a private channel can still trigger interactive post actions on posts within that private channel by using a cookie obtained from any channel they do have access to.

Impact Analysis

This vulnerability can allow an authenticated user to perform actions on posts in private channels they are not authorized to access.

While it does not allow reading the content of the private channel posts, it can impact the integrity of the channel by enabling unauthorized interactive post actions.

According to the CVSS score (6.5), the impact is considered to be of medium severity with high impact on integrity but no impact on confidentiality or availability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-10106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart