CVE-2026-93847: Improper post type validation on scheduled post endpoints
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and be a member of the target channel. Exploitation also requires interaction by a user.
What is the practical impact of exploitation?
A channel member can use the scheduled post endpoint to publish messages that render as trusted system events. The stated impact is integrity-only; confidentiality and availability are not affected.
Which deployments are identified as affected?
The affected versions are Mattermost 11.7.x through 11.7.10. The provided information does not state whether the vulnerable behavior is enabled in the default configuration.