CVE-2026-3637 json
Mattermost fails to enforce create_post permission when editing posts
published 2026-05-18 5 mo ago modified 2026-10-14 25 d ago also GHSA-v549-xx3c-6pc8 , GO-2026-5651 , EUVD-2026-30741
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 4%
- public exploits
- 0
- none known
Summary
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627
Patch / fix
- go github.com/mattermost/mattermost/server/v8 8.0.0-20260316171743-090408f09f53, 10.11.14, 11.4.4, 11.5.2
- go github.com/mattermost/mattermost-server 5.3.2-0.20260316171743-090408f09f53, 10.11.14+incompatible, 11.4.4+incompatible, 11.5.2+incompatible
- Mattermost Mattermost 10.11.14, 11.4.4, 11.5.2, 11.6.0
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost/server/v8 | >=10.11.0, <10.11.14 >=11.4.0, <11.4.4 <8.0.0-20260316171743-090408f09f53 >=11.5.0, <11.5.2 |
10.11.14 11.4.4 8.0.0-20260316171743-090408f09f53 11.5.2 |
| go | github.com/mattermost/mattermost-server | <5.3.2-0.20260316171743-090408f09f53 >=10.11.0+incompatible, <10.11.14+incompatible >=11.4.0+incompatible, <11.4.4+incompatible >=11.5.0+incompatible, <11.5.2+incompatible |
5.3.2-0.20260316171743-090408f09f53 10.11.14+incompatible 11.4.4+incompatible 11.5.2+incompatible |
| go | github.com/mattermost/mattermost-server/v5 | all versions |
no fix listed |
| go | github.com/mattermost/mattermost-server/v6 | all versions |
no fix listed |
Affected products
- Mattermost Mattermost
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
Sources
- CVE List CVE-2026-3637
- GitHub Advisory GHSA-v549-xx3c-6pc8
- NVD CVE-2026-3637
- OSV GO-2026-5651
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.