Live › vulnerability › CVE-2026-93847
Go to dashboardMattermost versions 11.7.x up to 11.7.10 do not validate reserved system post types on the scheduled post creation and publication paths. An authenticated channel member can publish messages that render as trusted system events through the scheduled post endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:02 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers running versions 11.7.x up to and including 11.7.10. An attacker must be a logged-in member of a channel where scheduled posts are enabled. Teams on other Mattermost versions can skip it.
No product ranges from the sources yet.
mattermost version or the System Console; unknown whether the sources give a specific build check.11.7.10 that includes the fix in MMSA-2026-00732; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732
This page as .md · .json · in your agent: get_signal("CVE-2026-93847")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.