MEDIUM
Incoming webhook user attribution via unvalidated webhook owner
Published Jul 13, 2026
4.9
MEDIUMCVSS 3.1
EPSS 0.36%
Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683
Affected products
-
- Version 10.11.0StatusaffectedConstraints<=10.11.19
- Version 11.6.0StatusaffectedConstraints<=11.6.4
- Version 11.7.0StatusaffectedConstraints<=11.7.2
- Version 10.11.20StatusunaffectedConstraints-
- Version 11.6.5StatusunaffectedConstraints-
- Version 11.7.3StatusunaffectedConstraints-
- Version 11.8.0StatusunaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mattermost | Mattermost | unaffected |
|
OR
- ≥ 10.11.0 · < 10.11.20
- ≥ 11.6.0 · < 11.6.5
- ≥ 11.7.0 · < 11.7.3
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
Update Mattermost to versions 11.8.0, 11.7.3, 11.6.5, 10.11.20 or higher.
Weaknesses (1)
References (1)
- https://mattermost.com/security-updates vendor-advisoryVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://mattermost.com/security-updates | vendor-advisoryVendor Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Mattermost
Published Jul 13, 2026
Updated Jul 13, 2026
Reserved May 27, 2026
Link CVE-2026-9708
CISA Vulnrichment
Updated Jul 13, 2026