CVE-2026-6062

Summary

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost11.7.0 <= 11.7.0affected
MattermostMattermost11.6.0 <= 11.6.2affected
MattermostMattermost11.5.0 <= 11.5.5affected
MattermostMattermost10.11.0 <= 10.11.17affected
MattermostMattermost11.8.0unaffected
MattermostMattermost11.7.1unaffected
MattermostMattermost11.6.3unaffected
MattermostMattermost11.5.6unaffected
MattermostMattermost10.11.18unaffected

Weaknesses

  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References