# CVE-2026-6342: Mattermost Plugins incorrect authorization in group subscriptions

Source: https://junglewise.ai/threats/cve-2026-6342-mattermost-plugins-incorrect-authorization-in-group-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-18. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-6342 · Severity: medium · CVSS 4.3 · Published 2026-05-18

Mattermost Plugins, which extend the functionality of the Mattermost collaboration platform, contain a security flaw in how they manage group subscriptions. An authorized user could bypass intended restrictions to join or subscribe to groups that should be off-limits by exploiting a naming inconsistency. This could lead to unauthorized access to group-based communications or notifications that were meant to be restricted to specific whitelisted sets.

Technologies: [Mattermost Plugins](https://junglewise.ai/threats/technologies/mattermost-plugins). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-6342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6342 being exploited in the wild.

**How severe is CVE-2026-6342?** Medium severity, with a CVSS score of 4.3, published 18 May 2026.

**Which products and versions are affected?** Mattermost Plugins <=11.5, 11.1.5, 10.13.11, 11.3.4.0.

**Is there a fix for CVE-2026-6342?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6342 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-6342?** Check whether you run Mattermost Plugins at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in Mattermost Plugins due to insufficient namespace validation. The software fails to strictly enforce whitelisting for group subscriptions, allowing an attacker with low-level privileges to subscribe to unauthorized groups if those groups share a name prefix with a legitimate, whitelisted group. This is a network-reachable vulnerability that requires authentication but no user interaction. The flaw allows for unauthorized integrity changes regarding group subscriptions. Fixes are typically addressed in subsequent Mattermost release cycles.

## Affected products

- Mattermost Mattermost Plugins <=11.5, 11.1.5, 10.13.11, 11.3.4.0

## Timeline

- 2026-05-18: disclosed: CVE published by NVD and Mattermost

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost Plugins sensitive information disclosure in OpenAI logging](https://junglewise.ai/threats/cve-2026-9699-mattermost-plugins-sensitive-information-disclosure-in-openai)
- [Mattermost Plugins path traversal in shared-channel attachment sync](https://junglewise.ai/threats/cve-2026-6957-mattermost-plugins-path-traversal-in-shared-channel-attachment)
- [Mattermost Plugins incorrect authorization in group API requests](https://junglewise.ai/threats/cve-2026-6341-mattermost-plugins-incorrect-authorization-in-group-api-requests)
- [Mattermost Plugins timestamp validation failure in Zoom webhook](https://junglewise.ai/threats/cve-2026-3109-mattermost-plugins-timestamp-validation-failure-in-zoom-webhook)