CVE-2026-93847
Improper post type validation on scheduled post endpoints
- State
- Published
- Severity
- 3.5 Low
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Sep 18, 2026
Description
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.5 Low | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N | Mattermost |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
MattermostMattermost |
|
References
- MMSA-2026-00732vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.