Mattermost versions 11.5.x up to 11.5.1 and 10.11.x up to 10.11.13 have a flaw where the enforced PostEditTimeLimit does not apply to certain non-message post fields such as file attachments, props, and pin status. This allows an authenticated user to modify these fields after the edit window has expired, effectively tampering with post data. The weakness reflects a failure to enforce established data restrictions (CWE‑672).

The vulnerability affects Mattermost deployments running the affected releases of the Mattermost product. Specifically, users of Mattermost 11.5.x and 10.11.x versions cannot rely on the edit time limit for the mentioned post fields until they update to a patched release.

The published CVSS score of 3.1 indicates low overall severity. No EPSS score is publicly available, and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, exploitation requires a valid authenticated session and the use of the post patch or update API endpoints, which are network-accessible. An attacker who has legitimate credentials can repeatedly alter post attachments, properties, and pin status after the configured edit period, impacting data integrity in collaborative environments.