Executive brief
Mattermost is a team communication and collaboration platform that manages channel-based message subscriptions. A vulnerability allows authenticated users to hijack subscriptions belonging to channels they don't have access to by sending crafted edit requests. An attacker could gain access to sensitive channel activity notifications or modify subscription settings for channels outside their authorized scope.
Technical details
This is an authorization bypass vulnerability (CWE-639) in Mattermost's subscription management API. The subscription edit endpoint (PUT request) fails to validate that the authenticated user owns or has access to the channel associated with an existing subscription before applying modifications. The vulnerability requires the attacker to be authenticated to the Mattermost instance and have knowledge of valid subscription identifiers, but no special privileges are needed for the target channel. An attacker can exploit this to hijack subscriptions from channels they have no access to, potentially gaining access to channel activity data or modifying notification settings. Patches are available in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.
Affected products
- Mattermost Mattermost Server >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Patched versions released: 11.7.1, 11.6.3, 11.5.6, 10.11.18