CVE-2026-9708: Incoming webhook user attribution via unvalidated webhook owner
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.3 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.20
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9708?
The severity of CVE-2026-9708 is medium with a CVSS score of 4.9.
How can I fix CVE-2026-9708?
To fix CVE-2026-9708, upgrade Mattermost to versions 11.7.3 or later, 11.6.5 or later, or 10.11.20 or later.
What is the impact of CVE-2026-9708?
CVE-2026-9708 allows a user with webhook management permissions to create posts or messages that appear to be sent by another user.
Which Mattermost versions are affected by CVE-2026-9708?
Mattermost versions 11.7.x up to 11.7.2, 11.6.x up to 11.6.4, and 10.11.x up to 10.11.19 are affected by CVE-2026-9708.
What type of vulnerability is CVE-2026-9708?
CVE-2026-9708 is a user attribution vulnerability related to incoming webhooks in Mattermost.