CVE-2026-3637

🔶 medium

Summary

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

CVSS Score

4.3

Medium

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-18

First Seen: 2026-05-19

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 5.4% of all 321,566 vulnerabilities in our database.

#304,103

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 18, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

0x7oda7123

SSVC data provided by CISA

Last Modified 2026-05-19

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE IDs (Weakness Types)

CWE-862

📦 Affected Products 3

Vendor	Product	Status	Affected Versions
mattermost	mattermost_server	Affected	> 10.11.0 < 10.11.14
mattermost	mattermost_server	Affected	> 11.4.0 < 11.4.4
mattermost	mattermost_server	Affected	> 11.5.0 < 11.5.2

🔗 References 1

https://mattermost.com/security-updates

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	Summary	Published
CVE-2026-28759	🔶 medium	4.3	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has a...	2026-05-18
CVE-2026-2325	🔶 medium	4.3	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body o...	2026-05-18
CVE-2026-3495	ℹ️ low	3.8	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to escape some variables that could contain malicious con...	2026-05-18
CVE-2026-4273	ℹ️ low	3.7	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate that the RefreshedToken differs from the orig...	2026-05-18
CVE-2026-6340	🔶 medium	4.3	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure befo...	2026-05-18
CVE-2026-28732	🔶 medium	4.3	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 Fail to enforce slash command trigger-word u...	2026-05-18

These CVEs affect the same products