40158 matches found
Mattermost doesn't check the create_post channel permission during post edit operations
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-5163
Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...
CVE-2026-1631
creationtimestamp| type| source ---|---|--- 2026-05-18 08:49:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4imms5k22h 2026-06-16 19:12:51+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3mogixe3cpn2h...
CVE-2026-6334
creationtimestamp| type| source ---|---|--- 2026-05-18 08:36:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hvnoaei2o...
CVE-2026-3637
creationtimestamp| type| source ---|---|--- 2026-05-18 08:30:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hj6o32x2p...
CVE-2026-3637
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-5163
Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...
CVE-2026-42656
creationtimestamp| type| source ---|---|--- 2026-05-18 07:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm4edghucm2l...
CVE-2026-46489
creationtimestamp| type| source ---|---|--- 2026-05-18 07:02:50+00:00| seen| https://bsky.app/profile/releaseport.com/post/3mm4cln3l4l2s 2026-06-11 22:10:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2ak5zje723 2026-06-15 01:01:13+00:00| seen|...
CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
EUVD-2026-30741
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-3637
Mattermost versions affected: 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x
CVE-2026-3637
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...
CVE-2026-2325
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...
CVE-2026-8783
creationtimestamp| type| source ---|---|--- 2026-05-18 06:22:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4aemodku2k...
CVE-2026-8784
creationtimestamp| type| source ---|---|--- 2026-05-18 06:17:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4a3o75zb2k...