CVE-2026-27659: Mattermost Server CSRF Vulnerability

CVE-2026-27659 Overview

CVE-2026-27659 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Mattermost Server. The vulnerability exists due to improper validation of CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint. This flaw allows an attacker to craft a malicious request that, when triggered by an authenticated administrator, can modify access control policy active status without proper authorization verification.

Critical Impact

An attacker can trick administrators into inadvertently changing access control policy states, potentially enabling or disabling security policies that govern user permissions and data access within the Mattermost collaboration platform.

Affected Products

• Mattermost Server versions 11.2.x through 11.2.2
• Mattermost Server versions 10.11.x through 10.11.10
• Mattermost Server versions 11.4.x through 11.4.0
• Mattermost Server versions 11.3.x through 11.3.1

Discovery Timeline

• 2026-03-25 - CVE-2026-27659 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-27659

Vulnerability Analysis

This CSRF vulnerability (CWE-352) allows attackers to perform unauthorized state changes on access control policies within Mattermost Server. The core issue lies in the insufficient validation of anti-CSRF tokens when processing requests to the access control policy activation endpoint.

When an administrator is logged into Mattermost and visits a malicious website controlled by an attacker, the attacker can trigger a forged request to the vulnerable endpoint. Because the endpoint does not properly verify that the request originated from a legitimate user action within the Mattermost application, the server processes the request as if it were a legitimate administrative action.

The exploitation requires user interaction—specifically, the victim administrator must visit an attacker-controlled page while authenticated to the Mattermost instance. This attack targets the integrity of access control configurations, which could lead to unauthorized access if security policies are inadvertently disabled.

Root Cause

The vulnerability stems from inadequate CSRF protection implementation on the /api/v4/access_control_policies/{policy_id}/activate API endpoint. The endpoint either fails to require a valid CSRF token, improperly validates the token, or accepts requests without verifying the token's presence. This oversight allows cross-origin requests to successfully modify access control policy states when accompanied by the victim's valid session credentials.

Attack Vector

The attack leverages network-based access, requiring low privileges and user interaction. An attacker constructs a malicious webpage containing a hidden form or JavaScript code that automatically submits a request to the vulnerable Mattermost endpoint when loaded. The attacker then distributes the malicious link to target administrators through phishing emails, social engineering, or by embedding it in legitimate-looking content.

When an authenticated Mattermost administrator visits the malicious page, their browser automatically includes session cookies with the forged request. The Mattermost server, failing to properly validate the CSRF token, processes the request and toggles the access control policy status.

The attack typically involves crafting an HTTP POST request to /api/v4/access_control_policies/{policy_id}/activate with appropriate parameters to either enable or disable targeted access control policies. This manipulation of security configurations can weaken the organization's security posture.

Detection Methods for CVE-2026-27659

Indicators of Compromise

• Unexpected changes to access control policy activation states in Mattermost audit logs
• HTTP requests to /api/v4/access_control_policies/*/activate originating from external referrers
• Anomalous access control policy modifications occurring shortly after administrator web browsing sessions
• Cross-origin requests targeting the access control policy API endpoints

Detection Strategies

• Monitor Mattermost Server logs for policy activation/deactivation events that occur without corresponding administrative UI interactions
• Implement web application firewall rules to detect and block suspicious cross-origin requests to sensitive API endpoints
• Review HTTP referrer headers for requests to access control policy endpoints to identify potentially forged requests
• Deploy endpoint detection solutions to identify malicious webpages attempting CSRF attacks against internal applications

Monitoring Recommendations

• Enable verbose logging for access control policy changes within Mattermost administrative settings
• Configure alerts for any modification to access control policies outside of expected maintenance windows
• Implement network traffic analysis to identify unusual patterns of API calls to the affected endpoint

How to Mitigate CVE-2026-27659

Immediate Actions Required

• Upgrade Mattermost Server to the latest patched version that addresses MMSA-2026-00578
• Review current access control policy configurations to ensure no unauthorized changes have occurred
• Audit recent administrative actions and access logs for signs of exploitation
• Educate administrators about CSRF attack vectors and the importance of not clicking untrusted links while authenticated

Patch Information

Mattermost has released security updates addressing this vulnerability. Refer to the Mattermost Security Updates page for the latest patched versions and detailed upgrade instructions. Organizations should prioritize updating to versions beyond the affected ranges: 11.2.2, 10.11.10, 11.4.0, and 11.3.1.

Workarounds

• Implement additional network-layer protections such as strict referrer policy enforcement on the web server
• Configure Content Security Policy headers to restrict form submissions to same-origin targets
• Use browser extensions or enterprise browser policies that block cross-origin form submissions for administrative users
• Consider implementing network segmentation to limit external access to Mattermost administrative interfaces

# Example: Configure nginx reverse proxy with strict referrer checking
location /api/v4/access_control_policies {
    if ($http_referer !~* "^https://your-mattermost-domain\.com") {
        return 403;
    }
    proxy_pass http://mattermost_backend;
}