# CVE-2026-6062: Mattermost Server authorization bypass in subscription edit endpoint

Source: https://junglewise.ai/threats/cve-2026-6062-mattermost-server-authorization-bypass-in-subscription-edit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-6062 · Severity: medium · CVSS 6.4 · Published 2026-06-22

Mattermost is a team communication and collaboration platform that manages channel-based message subscriptions. A vulnerability allows authenticated users to hijack subscriptions belonging to channels they don't have access to by sending crafted edit requests. An attacker could gain access to sensitive channel activity notifications or modify subscription settings for channels outside their authorized scope.

Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-6062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6062 being exploited in the wild.

**How severe is CVE-2026-6062?** Medium severity, with a CVSS score of 6.4, published 22 June 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.5.0+incompatible,fixed=11.5.6+incompatible,introduced=11.6.0+incompatible,fixed=11.6.3+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost Server >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18, 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17.

**Is there a fix for CVE-2026-6062?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6062 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-6062?** Check whether you run github.com/mattermost/mattermost-server (Go) or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later

  ```sh
  go get github.com/mattermost/mattermost-server@v11.7.1+incompatible
  ```


## Technical details

This is an authorization bypass vulnerability (CWE-639) in Mattermost's subscription management API. The subscription edit endpoint (PUT request) fails to validate that the authenticated user owns or has access to the channel associated with an existing subscription before applying modifications. The vulnerability requires the attacker to be authenticated to the Mattermost instance and have knowledge of valid subscription identifiers, but no special privileges are needed for the target channel. An attacker can exploit this to hijack subscriptions from channels they have no access to, potentially gaining access to channel activity data or modifying notification settings. Patches are available in versions 11.7.1, 11.6.3, 11.5.6, and 10.11.18.

## Affected products

- Mattermost Mattermost Server >= 11.7.0, < 11.7.1; >= 11.6.0, < 11.6.3; >= 11.5.0, < 11.5.6; >= 10.11.0, < 10.11.18

## Identifiers

- CVE-2026-6062
- GHSA-mxq2-5jpg-7474
- GO-2026-6484

## Timeline

- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-06-22: patched: Patched versions released: 11.7.1, 11.6.3, 11.5.6, 10.11.18

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)