{"id":"CVE-2026-93847","kind":"vulnerability","aliases":["CVE-2026-93847"],"related":[],"title":"Mattermost: scheduled posts can spoof trusted system messages in chat","description":"Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732","summary":"Mattermost versions 11.7.x up to 11.7.10 do not validate reserved system post types on the scheduled post creation and publication paths. An authenticated channel member can publish messages that render as trusted system events through the scheduled post endpoint.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chat","mattermost","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console; unknown whether the sources give a specific build check.","fix":"- Upgrade Mattermost to a release past `11.7.10` that includes the fix in MMSA-2026-00732; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","triaged_at":"2026-10-26T16:03:59+00:00","updated_at":"2026-10-26T16:03:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T16:03:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mattermost to a release past `11.7.10` that includes the fix in MMSA-2026-00732; the exact fixed version is unknown from the sources.","reach":"network","title":"Mattermost: scheduled posts can spoof trusted system messages in chat","impact":"low","summary":"Mattermost versions 11.7.x up to 11.7.10 do not validate reserved system post types on the scheduled post creation and publication paths. An authenticated channel member can publish messages that render as trusted system events through the scheduled post endpoint.","category":"package","nicknames":[],"who_cares":["mattermost","self-hosted","chat"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker spoofs trusted system messages inside a chat channel","analyst_note":"Confirm the fixed Mattermost version and the upgrade path in advisory MMSA-2026-00732 (Mattermost security bulletins).","how_to_check":"- Check the Mattermost server version with `mattermost version` or the System Console; unknown whether the sources give a specific build check.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Self-hosted or managed Mattermost servers running versions 11.7.x up to and including 11.7.10. An attacker must be a logged-in member of a channel where scheduled posts are enabled. Teams on other Mattermost versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000596,"input_tokens":3330,"output_tokens":526,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-00732':108C '-2026':12A,15A,107C '-93847':13A,16A '..':102C '11.7':25B,65C '11.7.10':29B,67C 'advisori':104C 'allow':84C 'authent':46B,86C 'channel':47B,87C 'chat':10A,17B 'creation':41B,79C 'cve':11A,14A 'endpoint':62B,101C 'event':57B,96C 'fail':68C 'host':22B 'id':105C 'mattermost':1A,18B,23B,63C,103C 'member':48B,88C 'messag':8A,51B,91C 'mmsa':106C 'packag':19B 'path':44B,82C 'post':3A,35B,40B,61B,73C,78C,100C 'public':43B,81C 'publish':50B,90C 'render':53B,92C 'reserv':33B,71C 'schedul':2A,39B,60B,77C,99C 'self':21B 'self-host':20B 'spoof':5A 'system':7A,34B,56B,72C,95C 'trust':6A,55B,94C 'type':36B,74C 'valid':32B,70C 'version':24B,64C 'via':97C 'x':26B,66C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Mattermost servers running versions 11.7.x up to and including 11.7.10. An attacker must be a logged-in member of a channel where scheduled posts are enabled. Teams on other Mattermost versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_by":"responsibledisclosure@mattermost.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93847","severity":null,"published_at":"2026-10-26T15:16:46+00:00","modified_at":"2026-10-26T15:16:46+00:00","first_seen_at":"2026-10-26T16:02:26+00:00","fetched_at":"2026-10-26T16:02:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}