CVE-2026-10106: Mattermost Server Auth Bypass Vulnerability

CVE-2026-10106 Overview

CVE-2026-10106 is an authorization flaw in Mattermost Server that allows authenticated users to trigger interactive post actions in private channels they cannot access. The vulnerability exists in versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, and 10.11.x <= 10.11.19. The server fails to verify that the channel referenced in an action cookie matches the channel of the target post. An attacker with access to any channel can reuse a cookie to invoke actions on posts in restricted channels. Mattermost tracks this issue as advisory MMSA-2026-00690 and classifies it under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users can trigger interactive post actions on posts in private channels they are not members of, undermining channel isolation and data integrity.

Affected Products

Mattermost Server 11.7.x up to and including 11.7.2
Mattermost Server 11.6.x up to and including 11.6.4
Mattermost Server 10.11.x up to and including 10.11.19

Discovery Timeline

2026-07-13 - CVE-2026-10106 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-10106

Vulnerability Analysis

Mattermost supports interactive post actions such as buttons and menus. When a user interacts with these elements, the client submits an action cookie that references the originating channel and post. The server must validate that the cookie's channel matches the target post's channel before executing the action.

This validation step is missing in the affected versions. An authenticated user can capture an action cookie from any channel they can access, then submit it against a post in a private channel. The server processes the action without checking membership in the target channel. This bypasses the access control model that isolates private channel content from non-members.

The issue is an authorization defect [CWE-863] rather than an authentication weakness. Attackers require valid credentials but no elevated privileges. Impact centers on integrity, since actions can modify state associated with restricted posts. Confidentiality and availability are not directly affected.

Root Cause

The root cause is missing server-side verification of the channel identifier embedded in the action cookie. The handler trusts the cookie's channel reference instead of resolving the target post's channel and confirming the requesting user has access to it. This omission breaks the invariant that post actions must respect channel membership.

Attack Vector

Exploitation requires network access to the Mattermost instance and valid user credentials. The attacker joins or already belongs to any accessible channel that contains interactive post actions. They obtain a valid action cookie from that channel and craft a request that targets a post identifier in a private channel where they lack membership. The server executes the action because it does not cross-check the cookie's channel against the target post's channel.

No user interaction is required from victims. The attack does not require administrative privileges. See the Mattermost Security Updates advisory for vendor guidance.

Detection Methods for CVE-2026-10106

Indicators of Compromise

Post action requests where the channel_id in the action cookie does not match the channel of the referenced post_id.
Audit log entries showing interactive action invocations by users who are not members of the target channel.
Repeated post action submissions from a single user across many distinct post identifiers in a short window.

Detection Strategies

Enable Mattermost audit logging and forward events to a central SIEM for correlation of action invocations against channel membership state.
Build a rule that joins post action events with channel membership tables and alerts when the acting user lacks access to the target channel.
Baseline normal post action volumes per user and flag statistical outliers indicative of automated cookie reuse.

Monitoring Recommendations

Monitor Mattermost application logs for requests to /api/v4/actions/dialogs/open and post action endpoints with mismatched channel context.
Track user session activity that spans many private channels within short intervals.
Review integrations and bots that emit interactive messages, since their action cookies are the most likely reuse targets.

How to Mitigate CVE-2026-10106

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.7.2, 11.6.4, or 10.11.19 per the vendor advisory.
Inventory all Mattermost instances, including self-hosted deployments, and confirm patch status.
Review recent audit logs for post action events involving private channels to identify prior misuse.

Patch Information

Mattermost has released fixed versions addressing advisory MMSA-2026-00690. Administrators should consult the Mattermost Security Updates page for the specific patched version numbers corresponding to each affected release branch and apply them following standard upgrade procedures.

Workarounds

Restrict use of interactive post actions from integrations and bots until patching is complete.
Limit membership of channels that contain sensitive interactive content and remove stale users.
Rotate personal access tokens and session tokens for users suspected of abusing action cookies.

bash

# Verify installed Mattermost server version before and after upgrade
mattermost version

# Example upgrade path for a Linux tarball installation
systemctl stop mattermost
tar -xvzf mattermost-<fixed-version>-linux-amd64.tar.gz
systemctl start mattermost