CVE-2026-28759: Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28759?
CVE-2026-28759 is classified as a high-severity vulnerability due to insufficient authorization in shared channel membership sync.
How do I fix CVE-2026-28759?
To fix CVE-2026-28759, upgrade Mattermost to versions 11.5.2, 10.11.14, or 11.4.4 or later.
What versions are affected by CVE-2026-28759?
CVE-2026-28759 affects Mattermost versions 11.5.1 and earlier, 10.11.13 and earlier, and 11.4.3 and earlier.
What are the implications of CVE-2026-28759?
CVE-2026-28759 allows a remote cluster to remove users from arbitrary channels, potentially impacting user access and security.
Is there a workaround for CVE-2026-28759?
There is currently no known workaround for CVE-2026-28759; upgrading is the recommended approach.