CVE-2026-10103 — Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared cha…

CVE-2026-10103

Authenticated remote cluster can modify or delete posts it does not own in Mattermost Connected Workspaces shared channels PUBLISHED

Description (CNA)

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 11.7.0 through 11.7.2; affected 11.6.0 through 11.6.4; affected 10.11.0 through 10.11.19; unaffected 11.8.0; unaffected 11.7.3; unaffected 11.6.5; unaffected 10.11.20

CWE

CWE-639

References

https://mattermost.com/security-updates

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.