Live › vulnerability › CVE-2026-18795
Go to dashboardMattermost fails to check on the server that a post belongs to a direct or group message before letting a user quarantine it via the API. An authenticated user can therefore quarantine DM or GM posts they should not be able to act on.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers running one of the affected 11.x versions are exposed, since any signed-in user can make the quarantine call. Teams on unaffected versions or who restrict accounts to trusted users have less exposure, but the sources do not say which configurations are safe.
No product ranges from the sources yet.
mattermost version or the System Console and compare against the affected ranges: 11.10.x up to 11.10.0, 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.9.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
This page as .md · .json · in your agent: get_signal("CVE-2026-18795")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.