CVE-2026-10542: Mattermost Auth Bypass Vulnerability

CVE-2026-10542 Overview

CVE-2026-10542 is an authorization vulnerability in multiple Mattermost versions. The flaw resides in the channel action update endpoint, which fails to validate channel action ownership. Channel managers can update actions belonging to channels they do not administer, breaking tenant boundaries within the collaboration platform. The issue is tracked under Mattermost Advisory ID MMSA-2026-00692 and classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated channel managers can modify channel actions across arbitrary channels, resulting in low-level compromise of confidentiality, integrity, and availability of collaboration data.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4 and 11.7.x versions <= 11.7.7
Mattermost 10.11.x versions <= 10.11.22

Discovery Timeline

2026-09-14 - CVE-2026-10542 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-10542

Vulnerability Analysis

Mattermost supports channel actions, which are automated workflows attached to a specific channel. The channel action update endpoint accepts an action identifier from the requesting client. The server retrieves and updates the referenced action without verifying that the action belongs to a channel the requester manages. A user holding channel manager privileges in any channel can therefore modify actions defined in unrelated channels.

This is a server-side authorization defect. The endpoint checks that the caller holds the channel manager role but does not correlate the target action with the caller's scope of authority. The result is horizontal privilege escalation across channel boundaries.

Root Cause

The root cause is missing ownership validation on a mutating API endpoint, aligned with [CWE-639]. The action identifier operates as a user-controlled key. The service trusts the identifier without cross-checking that the caller has authority over the parent channel of that action.

Attack Vector

Exploitation requires network access to the Mattermost API and authenticated privileges as a channel manager in at least one channel. The attacker enumerates or guesses channel action identifiers and submits update requests to the vulnerable endpoint. High attack complexity reflects the need to know or discover valid target action identifiers. No user interaction is required.

No public proof of concept, exploit code, or CISA KEV listing is associated with this CVE. See the Mattermost Security Updates advisory for endpoint-specific technical details.

Detection Methods for CVE-2026-10542

Indicators of Compromise

Unexpected modifications to channel action configurations logged in the Mattermost audit trail.
API calls to the channel action update endpoint originating from users who are not managers of the target channel.
Sudden changes to automated workflow payloads, webhook URLs, or slash command bindings in channels not owned by the modifying account.

Detection Strategies

Enable Mattermost audit logging and alert on channel action update events where the acting user's channel role does not include the target channel.
Correlate PUT requests against the channel actions API path with channel membership data to flag cross-channel modifications.
Baseline normal channel action change frequency per user and alert on statistical outliers.

Monitoring Recommendations

Ship Mattermost application and audit logs to a centralized analytics platform for retention and correlation.
Monitor the ratio of channel action updates to channel management assignments per user account.
Review privileged account activity for channel managers on a recurring basis.

How to Mitigate CVE-2026-10542

Immediate Actions Required

Upgrade Mattermost to a fixed release above the affected version ranges listed in the Mattermost Security Updates advisory.
Audit existing channel actions for unauthorized modifications made prior to patching.
Rotate any secrets, webhooks, or tokens embedded in channel actions that may have been tampered with.

Patch Information

Mattermost has published fixes under advisory MMSA-2026-00692. Administrators should consult the Mattermost Security Updates portal to identify the appropriate patched release for their deployment branch (10.11.x, 11.7.x, 11.8.x, or 11.9.x) and follow the standard upgrade procedure.

Workarounds

Restrict the channel manager role to a minimal set of trusted operators until patching is complete.
Place the Mattermost API behind a reverse proxy or web application firewall that logs and rate-limits requests to channel action endpoints.
Increase audit log retention and review cadence to detect unauthorized channel action changes quickly.

bash

# Verify current Mattermost server version before and after upgrade
mattermost version

# Example: review recent channel action update audit events (jq required)
tail -n 10000 /opt/mattermost/logs/audit.log \
  | jq 'select(.event=="updateChannelAction")'