CVE-2026-18795: Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Patch MMSA-2026-00756
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Mattermost user with access to make direct API calls can exploit it. The attack does not require user interaction, but the CVSS vector indicates high attack complexity.
Which deployments are affected?
Mattermost 11.10.0, 11.7.9 and earlier within the 11.7.x line, 11.9.1 and earlier within the 11.9.x line, and 11.8.5 and earlier within the 11.8.x line are affected. The issue concerns direct API handling of posts in direct-message and group-message conversations.
What is the impact of successful exploitation?
An attacker can quarantine a post belonging to a direct-message or group-message conversation. The listed impact includes high confidentiality impact and low integrity and availability impact.