CVE-2026-10085 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.1… | CVSS 5.4 MEDIUM

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688

Metadata

CVE ID: CVE-2026-10085
State: PUBLISHED
Assigner: Mattermost
Reserved: 2026-05-29 11:54 UTC
Published: 2026-07-13 08:05 UTC
Last updated: 2026-07-13 13:57 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: Mattermost / Mattermost
Sources: cve.org · NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Mattermost	Mattermost	—	11.7.0 ≤ 11.7.2, 11.6.0 ≤ 11.6.4, 10.11.0 ≤ 10.11.19, 11.8.0 …

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.4	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References (1)

MMSA-2026-00688 https://mattermost.com/security-updates