CVE-2026-4053: post edit time limit is not enforced on some post update operations
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4053?
CVE-2026-4053 is classified as a medium severity vulnerability due to its potential for unauthorized modifications.
How do I fix CVE-2026-4053?
To fix CVE-2026-4053, upgrade to Mattermost version 11.5.2 or later, or 10.11.14 or later, which address the enforcement of post edit time limits.
What are the affected versions of Mattermost for CVE-2026-4053?
The affected versions of Mattermost for CVE-2026-4053 include 11.5.0 to 11.5.1 and 10.11.0 to 10.11.13.
Who can exploit CVE-2026-4053?
An authenticated user with access to modify posts can exploit CVE-2026-4053 due to insufficient enforcement of the PostEditTimeLimit.
What type of operations does CVE-2026-4053 affect?
CVE-2026-4053 affects non-message post fields, allowing changes to file attachments, props, and pin status after the edit window.