Vulnerability · Published Apr 15, 2026 · Assigned by Mattermost

CVE-2026-27769Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Low 2.7

In plain English

A low-severity missing authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.2%top 94.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API.. Mattermost Advisory ID: MMSA-2026-00603

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/mattermost-server	8.0.0-20260316060126-bc1a2b34b1f9	GHSA-mxxh-fmjq-j6x4
Go	github.com/mattermost/mattermost-server	no fix listed	GO-2026-5522

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	10.11.0 – through 10.11.12

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

References

MMSA-2026-00603 vendor-advisory