---
id: "CVE-2026-93847"
kind: "vulnerability"
aliases: ["CVE-2026-93847"]
title: "Mattermost: scheduled posts can spoof trusted system messages in chat"
severity: "low"
cvss: 3.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chat", "mattermost", "package", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-26T15:16:46+00:00"
first_seen_at: "2026-10-26T16:02:26+00:00"
updated_at: "2026-10-26T16:03:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93847", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# Mattermost: scheduled posts can spoof trusted system messages in chat

Mattermost versions 11.7.x up to 11.7.10 do not validate reserved system post types on the scheduled post creation and publication paths. An authenticated channel member can publish messages that render as trusted system events through the scheduled post endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Mattermost server version with `mattermost version` or the System Console; unknown whether the sources give a specific build check.

## Fix

- Upgrade Mattermost to a release past `11.7.10` that includes the fix in MMSA-2026-00732; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93847

## From the sources

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_