Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-14T11:17:02.447Z",
  "pubdate": "2026-09-14T11:17:02.447Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw, specifically an Insecure Direct Object Reference (IDOR) or Broken Access Control issue, affecting the channel action management functionality in Mattermost.\nThe vulnerability allows an authenticated user with channel manager privileges in one channel to manipulate channel actions associated with other channels where they do not possess administrative authority.\nAffected products include Mattermost versions 11.9.0 and earlier, 11.8.4 and earlier, 11.7.7 and earlier, and 10.11.22 and earlier.\nThe risk is high because it permits unauthorized configuration changes, potentially leading to unauthorized workflow execution, data exfiltration, or the disruption of automated channel processes.\nExploitation requires the attacker to be an authenticated user with at least channel manager privileges within any channel, which they then abuse to target out-of-scope resource identifiers.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Mattermost API endpoint responsible for updating channel actions to perform a server-side authorization check against the requesting user's permissions for the specific target channel ID.\nThe application design erroneously assumes that if a user is authorized to perform 'channel action' updates generally, they are authorized to perform them on any action ID provided in the request body or parameters.\nThe attack flow begins with an authenticated attacker, who acts as a channel manager in 'Channel A', identifying the API endpoint responsible for updating channel actions. By observing legitimate traffic, the attacker identifies the parameter used to specify the action identifier.\nThe attacker then crafts a malicious HTTP request directed at the channel action update endpoint. Instead of providing the identifier for an action within 'Channel A', the attacker substitutes the ID of an action belonging to 'Channel B', where the attacker holds no administrative privileges.\nBecause the backend service fails to validate that the requested action ID corresponds to a channel in which the requester has sufficient authorization, the server processes the modification request.\nThis allows the attacker to alter, disable, or redirect channel actions in channels they should not have access to, effectively bypassing intended authorization boundaries. The impact includes the ability to interfere with automated integrations, potentially altering business logic or intercepting automated reports/events.\nThis flaw effectively treats the action ID as a trusted input without performing a corresponding ownership validation, confirming the vulnerability as a failure to implement proper access control checks during the request lifecycle.\nThe exposure is confined to authenticated sessions, meaning an unauthenticated attacker cannot exploit this; however, in a multi-tenant or large enterprise environment, this represents a significant privilege escalation vector."
}