CVE-2026-10085

Ordinary group/direct message member can enable group_constrained and remove all channel participants

Published Jul 13, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Description

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688

Analysis

Technical impact

The vulnerability allows any authenticated ordinary group or direct message member to set the group_constrained flag on a channel through the channel patch API. Because the flag is not appropriately restricted to only public or private channels that support group synchronization, the member can remove all participants from the conversation, effectively ending the channel. This loss of channel membership disrupts communication within the affected channel.

Affected Systems

Mattermost versions 10.11.x up to 10.11.19, 11.6.x up to 11.6.4, and 11.7.x up to 11.7.2 are impacted.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate risk level. The EPSS score of <1% suggests a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. An attacker only needs basic authenticated access to a channel as a regular member and can use the channel patch API to trigger the flaw. No elevated privileges are required, making the vulnerability a realistic threat in environments where ordinary members have unrestricted patch rights.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mattermost

unaffected

Version	Status	Constraints
`11.7.0`	affected	≤ 11.7.2
`11.6.0`	affected	≤ 11.6.4
`10.11.0`	affected	≤ 10.11.19
`11.8.0`	unaffected	—
`11.7.3`	unaffected	—
`11.6.5`	unaffected	—
`10.11.20`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::
	cpe:2.3:a:mattermost:mattermost_server::::::::

No data.

Vendor Product Versions

Mattermost

Version	Status	Scheme	Platform
`[11.7.0,11.7.2]`	affected	semver	—
`[11.6.0,11.6.4]`	affected	semver	—
`[10.11.0,10.11.19]`	affected	semver	—
`11.8.0`	unaffected	semver	—
`11.7.3`	unaffected	semver	—
`11.6.5`	unaffected	semver	—
`10.11.20`	unaffected	semver	—

Remediation

Vendor Solution

Update Mattermost to versions 11.8.0, 11.7.3, 11.6.5, 10.11.20 or higher.

OpenCVE Recommended Actions

Update Mattermost to any version 11.8.0, 11.7.3, 11.6.5, 10.11.20 or newer, which contain the patch for group_constrained flag handling.
Restrict channel patch permissions so that only authorized roles can modify channel flags, particularly the group_constrained attribute.
Identify existing channels where the group_constrained flag may have been set and reset or remove it if unnecessary; monitor API activity for unexpected channel patch operations.

Generated by OpenCVE AI on August 1, 2026 at 10:47 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.287% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://mattermost.com/security-updates

History

Jul 13, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 9:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mattermost Mattermost mattermost
Vendors & Products		Mattermost Mattermost mattermost

Jul 13, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-00688
Title		Ordinary group/direct message member can enable group_constrained and remove all channel participants
Weaknesses		CWE-862
References		https://mattermost.com/security-updates
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}`