CVE-2026-18795 — Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to qua…
Published: 2026-10-16 · CVSS: 6.4 · CVSS 3.1
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7