CVE-2026-18799: Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost Serverto a version that resolves this vulnerability.Fixed in 11.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have team administrator privileges. They can target existing Mattermost users by including those users' email addresses in a crafted Slack export.
What could an attacker do after exploiting it?
The attacker can force-add existing Mattermost users to the attacker's team and create forged posts attributed to those users' identities. The reported impact is integrity-only; no confidentiality or availability impact is specified.
Which releases are identified as affected?
Affected releases are Mattermost Server 11.10.0 and earlier in the 11.10.x line, 11.7.9 and earlier in the 11.7.x line, 11.9.1 and earlier in the 11.9.x line, and 11.8.5 and earlier in the 11.8.x line.