CVE-2026-6062

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost version 11.6.2 Mattermost version 11.5.5 Mattermost version 10.11.17

Description An issue exists where the system fails to validate channel ownership of an existing subscription before applying edits. This allows an authenticated attacker to hijack subscriptions from channels they have no access to by sending a crafted PUT request to the subscription edit endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.