Medium severity4.3NVD Advisory· Published May 18, 2026· Updated May 18, 2026
CVE-2026-28759
CVE-2026-28759
Description
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/mattermost/mattermost/server/v8Go | >= 11.5.0, < 11.5.2 | 11.5.2 |
github.com/mattermost/mattermost/server/v8Go | >= 10.11.0, < 10.11.14 | 10.11.14 |
github.com/mattermost/mattermost/server/v8Go | >= 11.4.0, < 11.4.4 | 11.4.4 |
github.com/mattermost/mattermost/server/v8Go | < 8.0.0-20260216150504-8738f8c4b3d4 | 8.0.0-20260216150504-8738f8c4b3d4 |
github.com/mattermost/mattermost-serverGo | < 5.3.2-0.20260216150504-8738f8c4b3d4 | 5.3.2-0.20260216150504-8738f8c4b3d4 |
Affected products
4cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*range: >=10.11.0,<10.11.14
- (no CPE)range: >=11.5.0 <11.5.2, >=10.11.0 <10.11.14, >=11.4.0 <11.4.4
- ghsa-coords2 versionspkg:golang/github.com/mattermost/mattermost-serverpkg:golang/github.com/mattermost/mattermost/server/v8
< 5.3.2-0.20260216150504-8738f8c4b3d4+ 1 more
- (no CPE)range: < 5.3.2-0.20260216150504-8738f8c4b3d4
- (no CPE)range: >= 11.5.0, < 11.5.2
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-8h9w-w78c-vvr3ghsaADVISORY
- mattermost.com/security-updatesnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-28759ghsaADVISORY
- github.com/mattermost/mattermost/commit/8738f8c4b3d42b2b687a6231e72f313357a2e891ghsaWEB
News mentions
0No linked articles in our index yet.