Executive brief
Mattermost, a collaboration and messaging platform, contains a flaw where it fails to properly verify user permissions when a message is edited. This allows a user whose posting privileges have been revoked to still modify their existing messages by bypassing the standard interface. While this does not expose private data, it allows unauthorized changes to communication history within the platform.
Technical details
A missing authorization check (CWE-862) exists in the Mattermost server's post update and patch endpoints. Specifically, the application fails to validate the 'create_post' channel permission when a user attempts to edit an existing message. An authenticated attacker with network access to the API can exploit this by sending direct REST API requests to modify their own historical posts, even if their permission to post in that specific channel has been revoked. The vulnerability is addressed by adding permission checks to the updatePost function in the server's API layer. Patches are available in versions 10.11.14, 11.4.4, and 11.5.2.
Affected products
- Mattermost Mattermost Server 10.11.x <= 10.11.13, 11.4.x <= 11.4.3, 11.5.x <= 11.5.1
Timeline
- 2026-05-18: disclosed
- 2026-05-18: advisory
- 2026-06-01: patched