Executive brief
Mattermost, a team collaboration and messaging platform, fails to validate that usernames assigned during bot registration actually belong to bot accounts rather than human users. An unprivileged attacker can exploit this by pre-registering a regular user account with a predictable bot username, allowing them to intercept private messages that plugins intended to send through direct message channels. This enables eavesdropping on sensitive plugin-to-user communications without authorization.
Technical details
The vulnerability stems from insufficient validation in the bot registration process (specifically the EnsureBot/EnsureBotUser function). During bot creation, if a username conflicts with an existing non-bot user account, the system fails to detect this mismatch and may return the human user's ID instead of rejecting the operation. An attacker with basic user account creation privileges can pre-register a regular account using a predictable bot service username (e.g., a plugin's well-known bot name), and when a plugin attempts to register its bot with that same username, the system incorrectly associates plugin communications with the attacker's human account. The attacker then receives direct messages intended only for the plugin bot. The fix validates that returned usernames correspond to actual bot accounts and returns an error on conflict, requiring patches in versions 11.6.1, 11.5.5, 10.11.17, and later.
Affected products
- Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 10.11.0 to 10.11.16
Timeline
- 2026-06-12: disclosed: Vulnerability disclosed via GHSA and CVE-2026-6046
- 2026-04-28: patched: Fix merged in PR #36064; patches released in versions 11.6.1, 11.5.5, 10.11.17