CVE-2026-18795
Received Received - Intake

Mattermost DM/GM Post Quarantine Bypass

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-18795
EUVD
EUVD-2026-102813

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.9 and 11.10.0 have a flaw where server-side checks for direct messages (DM) or group messages (GM) are not properly enforced. This allows an authenticated user to quarantine a post in a DM or GM through a direct API call, bypassing intended restrictions.

Impact Analysis

An attacker with valid credentials could misuse this flaw to quarantine or disrupt legitimate conversations in private DMs or GMs. This could lead to loss of critical communications, data integrity issues, or unauthorized content restriction within the platform.

Mitigation Strategies

Upgrade Mattermost to a version that is not affected by this vulnerability. Specifically, update to a version beyond 11.10.0, 11.7.9, 11.9.1, or 11.8.5 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart