PkgSeer

Vulnerability GHSA-mxq2-5jpg-7474

Medium Risk

2 months ago

Mattermost doesn't validate channel ownership of an existing subscription before applying edits

v10.11.0+incompatible - v10.11.17+incompatible and v11.5.0+incompatible - v11.5.5+incompatible and v11.6.0+incompatible - v11.6.2+incompatible and v11.7.0+incompatible

Summary

Mattermost doesn't validate channel ownership of an existing subscription before applying edits

Details

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Mattermost doesn't validate file ownership and access control in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5817

Mattermost doesn't sanitize team member data when returned via API to users without elevated permissions in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5818

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5820

Mattermost doesn't validate user-supplied input in API request handlers in github.com/mattermost/mattermost-plugin-github

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5833

Mattermost doesn't validate the TIFF IFD offset in the image header before allocating memory in github.com/mattermost/mattermost-server

v10.11.0+incompatible - v10.11.15-rc1+incompatible GO-2026-5835

View all vulnerabilities for these packages

Impacted packages

github.com/mattermost/mattermost-server

Timeline

Published

2 months ago

Last Modified

1 day ago