PT-2026-123370
CVE-2026-93847
·
Published
2026-10-26
·
Updated
2026-10-26
Description by
CVSS 3.1
3.5
LowMetricsAV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Mattermost versions 11.7.0 through 11.7.10
Description
An issue exists where reserved system post types are not validated during the creation and publication of scheduled posts. This allows an authenticated channel member to publish messages that appear as trusted system events through the scheduled post endpoint.
Recommendations
Update Mattermost to a version later than 11.7.10.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾