{"id":"CVE-2026-18795","kind":"vulnerability","aliases":["CVE-2026-18795"],"related":[],"title":"Mattermost: authenticated users can quarantine other users' direct message posts","description":"Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756","summary":"Mattermost fails to check on the server that a post belongs to a direct or group message before letting a user quarantine it via the API. An authenticated user can therefore quarantine DM or GM posts they should not be able to act on.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat","mattermost","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console and compare against the affected ranges: 11.10.x up to 11.10.0, 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.9.","fix":"- Upgrade Mattermost to a release outside the affected ranges (fixed versions unknown from the sources; see the Mattermost advisory MMSA-2026-00756).","status":"open","published_at":"2026-10-16T07:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:46+00:00","updated_at":"2026-10-25T03:59:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:59:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a release outside the affected ranges (fixed versions unknown from the sources; see the Mattermost advisory MMSA-2026-00756).","reach":"network","title":"Mattermost: authenticated users can quarantine other users' direct message posts","impact":"medium","summary":"Mattermost fails to check on the server that a post belongs to a direct or group message before letting a user quarantine it via the API. An authenticated user can therefore quarantine DM or GM posts they should not be able to act on.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","chat"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated users quarantine direct and group message posts they should not access","analyst_note":"Confirm fixed versions and whether the affected ranges include a patched 11.x release, using MMSA-2026-00756 and the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-18795.","how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console and compare against the affected ranges: 11.10.x up to 11.10.0, 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.9.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted or managed Mattermost servers running one of the affected 11.x versions are exposed, since any signed-in user can make the quarantine call. Teams on unaffected versions or who restrict accounts to trusted users have less exposure, but the sources do not say which configurations are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3395,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-00756':112C '-18795':13A,16A '-2026':12A,15A,111C '..':106C '11.10':68C '11.10.0':70C '11.7':71C '11.7.9':73C '11.8':77C '11.8.5':79C '11.9':74C '11.9.1':76C 'abl':63B 'act':65B 'advisori':108C 'allow':89C 'api':48B,104C 'authent':2A,50B,91C 'belong':33B,97C 'call':105C 'chat':17B 'check':26B,84C 'cve':11A,14A 'direct':8A,36B,103C 'dm':55B,99C 'dm/gm':83C 'enforc':82C 'fail':24B,80C 'gm':57B,101C 'group':38B 'host':22B 'id':109C 'let':41B 'mattermost':1A,18B,23B,66C,107C 'messag':9A,39B 'mmsa':110C 'packag':19B 'post':10A,32B,58B,96C 'quarantin':5A,44B,54B,94C 'self':21B 'self-host':20B 'server':29B,86C 'side':87C 'therefor':53B 'user':3A,7A,43B,51B,92C 'version':67C 'via':46B,102C 'x':69C,72C,75C,78C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Mattermost servers running one of the affected 11.x versions are exposed, since any signed-in user can make the quarantine call. Teams on unaffected versions or who restrict accounts to trusted users have less exposure, but the sources do not say which configurations are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18795","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18795","severity":null,"published_at":"2026-10-16T07:17:12+00:00","modified_at":"2026-10-16T19:23:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}