Mattermost versions 11.7.x up to 11.7.10 have a flaw where the system fails to validate reserved post types during scheduled post creation and publication. This bug, classified as CWE-863, allows an authenticated channel member to create a scheduled post that renders as a trusted system event. The impact is the ability to impersonate system messages, potentially hiding malicious activity or misleading other users.

The affected product is Mattermost, specifically versions 11.7.0 through 11.7.10. Versions 11.7.11 and any 11.11.0 release or newer have the issue fixed.

With a CVSS score of 3.5 the vulnerability is considered low severity, and no EPSS data is available. The flaw requires legitimate channel membership and does not expose remote code execution or data exfiltration. Since it is not listed in the CISA KEV catalog, exploits are not widely documented. An attacker would need to use the scheduled post endpoint, which is a normal feature, to send messages that appear as system events.