PT-2026-41348

CVE-2026-4053

Published

2026-05-15

Updated

2026-07-30

Description by

CVSS 3.1

4.3

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13

Description An issue exists where the system fails to enforce the PostEditTimeLimit on non-message post fields. This allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired by using the post patch and update API endpoints.

Recommendations Update Mattermost versions 11.5.0 through 11.5.1 to a version newer than 11.5.1. Update Mattermost versions 10.11.0 through 10.11.13 to a version newer than 10.11.13.

Exploitability

Exploit

Fix

Impacts

Researchers

Se1En

Vendors

Affected products

Weakness enumeration

CWE-672: Operation on a Resource after Expiration or Release

Related identifiers

CVE-2026-4053