CVE-2026-10085: Mattermost Server Auth Bypass Vulnerability

CVE-2026-10085 Overview

CVE-2026-10085 is a missing authorization vulnerability [CWE-862] in Mattermost Server. The flaw affects versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19. Mattermost tracks the issue as advisory MMSA-2026-00688.

The server fails to restrict the group_constrained channel flag to public and private channels that support group synchronization. An authenticated ordinary group member or direct message participant can abuse the channel patch API to remove all other participants from a conversation. The issue impacts integrity and availability of collaboration channels.

Critical Impact
An authenticated low-privileged user can eject every other member from a group or direct message channel by toggling the group_constrained flag through the channel patch API.

Affected Products

Mattermost Server 11.7.x through 11.7.2
Mattermost Server 11.6.x through 11.6.4
Mattermost Server 10.11.x through 10.11.19

Discovery Timeline

2026-07-13 - CVE-2026-10085 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-10085

Vulnerability Analysis

Mattermost exposes a channel patch API that allows privileged administrators to update channel attributes. One such attribute, group_constrained, ties channel membership to an external group synchronization source. When set, the server reconciles membership against the linked group and removes users who are not part of it.

The server does not validate the channel type before applying the flag. Group message and direct message channels do not support group synchronization, yet the API accepts the flag on those channel types. Once the flag is set on an unsupported channel, the reconciliation logic evicts every current participant because no group membership exists to satisfy the constraint.

This is a business logic and authorization defect. The action requires only standard authenticated access to the channel, so any member of a group or direct message conversation can trigger the mass removal.

Root Cause

The root cause is a missing authorization and input validation check on the channel patch endpoint. The handler applies the group_constrained field without verifying that the target channel type supports group synchronization. The flaw maps to [CWE-862: Missing Authorization].

Attack Vector

Exploitation requires network access to the Mattermost API and low-privileged authenticated access as a member of the target group or direct message channel. No user interaction from other participants is needed. The attacker sends a PATCH request to the channel endpoint setting group_constrained to true, which triggers the server to remove all other members. See the Mattermost Security Updates advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-10085

Indicators of Compromise

Channel patch API requests that set group_constrained to true against channels of type D (direct) or G (group message).
Sudden mass user removed from channel audit events on group or direct message channels within a short window.
Unexpected changes to the group_constrained field originating from non-administrator accounts.

Detection Strategies

Ingest Mattermost audit logs into your SIEM and alert on PATCH operations against /api/v4/channels/{channel_id} that modify the group_constrained property.
Correlate group_constrained flag changes with subsequent bulk membership removal events on the same channel.
Baseline which accounts legitimately administer group synchronization, and flag channel patch calls from any account outside that set.

Monitoring Recommendations

Enable Mattermost audit logging at the API layer and forward events to a centralized analytics platform.
Monitor for anomalous channel membership drops in direct and group message channels, which normally never change size beyond user-initiated actions.
Track Mattermost server version inventory to identify hosts still running vulnerable 11.7.x, 11.6.x, and 10.11.x builds.

How to Mitigate CVE-2026-10085

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.7.2, 11.6.4, or 10.11.19 on the respective branch.
Review recent channel patch API activity for unauthorized group_constrained changes and restore affected conversations.
Communicate the risk to users of group and direct message channels until the patch is deployed.

Patch Information

Mattermost has released fixed versions on the 11.7, 11.6, and 10.11 branches. Consult the Mattermost Security Updates page for the exact fixed versions and download instructions. The advisory identifier is MMSA-2026-00688.

Workarounds

Restrict access to the channel patch API at the reverse proxy layer for accounts that do not require administrative channel management.
Educate users that unexpected removal from a direct or group message channel should be reported immediately for investigation.
If patching is delayed, monitor audit logs for group_constrained modifications and revert offending changes.

bash

# Example: filter Mattermost audit logs for suspicious channel patch calls
grep -E 'PATCH /api/v4/channels/[a-z0-9]+' mattermost_audit.log \
  | grep 'group_constrained' \
  | grep -Ev '"channel_type":"(O|P)"'