Mattermost versions prior to 11.6.0, 11.5.2, 10.11.14, and 11.4.4 do not validate that a remote cluster is authorized to access a channel before processing membership removal requests during shared channel membership sync. This flaw enables a malicious remote cluster to craft membership sync messages that remove any user from any channel, including private channels, thereby bypassing authorization controls and disrupting communication.

The vulnerability impacts Mattermost, affecting releases 11.5.x up to 11.5.1, 10.11.x up to 10.11.13, and 11.4.x up to 11.4.3.

The CVSS score is 4.3, indicating a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Attackers need to control a remote cluster that can send synchronized membership messages; no direct end‑user credentials are required. The impact is limited to unauthorized removal of users but could disrupt team collaboration and expose private channel membership data. The risk remains moderate, especially in environments where untrusted remote clusters are allowed to sync with Mattermost.