Live › vulnerability › CVE-2026-93851
Go to dashboardMattermost's Agents plugin does not validate the target post ID in its mention reminder component. A user who can post in a channel an administrator can see can plant a crafted post that, when the administrator clicks it, makes the administrator's browser replace an installed plugin, which leads to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the affected 11.7, 11.8 and 11.9 lines that have the Agents plugin installed. The exposure depends on an authenticated user being able to post in a channel an administrator can see, and on an administrator clicking the crafted post. Instances on other version lines, or without the Agents plugin, are not listed as affected.
No product ranges from the sources yet.
mattermost version and compare it to the affected lines: 11.9.x up to 11.9.1, 11.8.x up to 11.8.5, 11.7.x up to 11.7.10.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks. Mattermost Advisory ID: MMSA-2026-00742
This page as .md · .json · in your agent: get_signal("CVE-2026-93851")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.