Live › vulnerability › CVE-2026-18799
Go to dashboardMattermost's Slack import does not limit account binding to imports started by a system administrator. A team admin can craft a Slack export containing other users' email addresses to force-add those users to their team and post messages attributed to them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost deployments on the affected version ranges where team admins can run Slack imports. Exposure requires a team admin account, so instances where only system administrators can import data are at lower risk. Deployments on versions outside the listed ranges can skip it.
No product ranges from the sources yet.
mattermost version or the System Console; affected builds are 11.7.x up to 11.7.9, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.x up to 11.10.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports which allows an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses.. Mattermost Advisory ID: MMSA-2026-00757
This page as .md · .json · in your agent: get_signal("CVE-2026-18799")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.