VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jul 13, 2026· Updated Jul 14, 2026

CVE-2026-10103

CVE-2026-10103

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689

Affected products

2
  • Mattermost/Mattermost2 versions
    cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: >=10.11.0,<10.11.20
    • (no CPE)range: <=11.7.2, <=11.6.4, <=10.11.19

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.