CVE-2026-27769 — Connected Workspaces: Malicious remote server can manipulate arbitrary user's status
Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected u…
Published: 2026-04-15 · CVSS: 2.7 · CVSS 3.1
Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API.. Mattermost Advisory ID: MMSA-2026-00603
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7