CVE-2026-10103: Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.3 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.20
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10103?
The severity of CVE-2026-10103 is medium, with a CVSS score of 4.3.
How do I fix CVE-2026-10103?
To fix CVE-2026-10103, upgrade to Mattermost versions 11.7.3 or later, 11.6.5 or later, and 10.11.20 or later.
What type of access does CVE-2026-10103 exploit?
CVE-2026-10103 exploits authenticated access, allowing remote clusters to modify or delete posts they do not own.
Which versions of Mattermost are affected by CVE-2026-10103?
The affected versions of Mattermost are 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19.
What kind of messages can be exploited in CVE-2026-10103?
CVE-2026-10103 can be exploited via crafted sync messages that reference posts authored by other users.