Mattermost versions 11.7.x through 11.7.2, 11.6.x through 11.6.4, and 10.11.x through 10.11.19 do not verify that the channel referenced in an action cookie matches the channel of the target post. This flaw, identified as CWE-863, allows an authenticated user who does not have access to a private channel to trigger interactive post actions on posts inside that private channel by using a cookie obtained from any accessible channel. The result is that the user can execute actions—such as modifying or deleting posts—without proper authorization, effectively escalating privileges for the attacker’s account.

Mattermost Mattermost is affected. The vulnerable releases are 11.7.0 to 11.7.2, 11.6.0 to 11.6.4, 10.11.0 to 10.11.19. All earlier versions are not impacted.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is < 1%, and the vulnerability is not reported in CISA's KEV catalog. Exploitation requires the attacker to be authenticated to a Mattermost instance and to possess a valid action cookie from any channel the attacker can access. The attacker then crafts a request that targets a private channel post, causing the server to process the action cookie as if it belonged to that channel. This attack is feasible over the network and could be used by insiders or compromised accounts to perform unauthorized actions within private channels.