CVE-2026-18799
Received Received - Intake

Forced User Impersonation in Mattermost via Slack Import

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-18799
EUVD
EUVD-2026-102751

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions between 11.7.9 and 11.10.0. It allows an authenticated attacker with team admin privileges to add existing Mattermost users to their team without permission by exploiting a crafted Slack export file containing target users' email addresses. The attacker can then forge posts under those users' identities.

Impact Analysis

An attacker could impersonate other users by posting messages under their names, potentially spreading misinformation or damaging reputations. This could lead to unauthorized access to team data or misuse of user identities within the Mattermost platform.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or impersonation, which may breach integrity and accountability controls in GDPR or HIPAA. Forged posts could also lead to non-compliance with record-keeping or audit trail requirements.

Mitigation Strategies

Upgrade Mattermost to a version that fixes this issue. Specifically, update to versions beyond 11.10.0, 11.7.9, 11.9.1, or 11.8.5 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart