CVE-2026-28759: Mattermost Server Auth Bypass Vulnerability

CVE-2026-28759 Overview

CVE-2026-28759 is an authorization vulnerability in Mattermost Server affecting the shared channel membership synchronization feature. The flaw allows a malicious remote cluster to remove arbitrary users from any channel, including private channels the remote cluster is not authorized to access. The vulnerability is tracked under Mattermost Advisory ID MMSA-2026-00576 and maps to CWE-863: Incorrect Authorization.

Affected versions include Mattermost Server 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3. Exploitation requires low-privilege network access from a federated remote cluster but no user interaction.

Critical Impact
A federated remote cluster can craft membership sync messages to forcibly remove users from any channel, including private channels outside the scope of the remote cluster's authorization.

Affected Products

Mattermost Server 11.5.x up to and including 11.5.1
Mattermost Server 11.4.x up to and including 11.4.3
Mattermost Server 10.11.x up to and including 10.11.13

Discovery Timeline

2026-05-18 - CVE-2026-28759 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-28759

Vulnerability Analysis

Mattermost supports shared channels across federated remote clusters. During membership synchronization, one cluster sends sync messages indicating membership changes that should propagate to peer clusters. The server processes these messages and updates local channel membership accordingly.

The vulnerable code path handles membership removal requests without verifying that the requesting remote cluster has authorization to act on the target channel. As a result, a remote cluster can target channels outside its shared scope and trigger membership removals for users it has no legitimate access to.

The Common Weakness Enumeration classifies this issue as CWE-863: Incorrect Authorization. The impact is limited to integrity of channel membership state. Confidentiality of channel content is not directly broken by the flaw, and availability of the broader service remains intact.

Root Cause

The root cause is a missing authorization check in the shared channel membership sync handler. The server trusts the channel identifier supplied in the inbound sync message and processes removal operations without validating that the source remote cluster is registered as a participant for that specific channel.

Attack Vector

An attacker must control a remote cluster federated with the victim Mattermost instance. The attacker then sends crafted membership sync messages referencing channel identifiers the cluster does not legitimately share. The target server processes the removal and evicts the specified user from the channel, including private channels. Refer to the Mattermost Security Updates advisory for protocol-level details.

Detection Methods for CVE-2026-28759

Indicators of Compromise

Unexpected ChannelMemberRemoved audit log entries originating from a remote cluster identifier for channels not declared as shared with that cluster.
User reports of being removed from private channels without administrator action.
Spikes in inbound shared channel sync traffic from a single remote cluster referencing diverse channel IDs.

Detection Strategies

Correlate Mattermost audit logs with the shared channel registry to flag membership removals where the source RemoteClusterId is not authorized for the target ChannelId.
Alert on membership churn in private channels triggered by federation events rather than local administrator actions.
Baseline normal shared channel sync volumes per remote cluster and alert on deviations.

Monitoring Recommendations

Forward Mattermost server and audit logs into a centralized SIEM and retain federation event metadata for incident review.
Monitor the /api/v4/remotecluster and shared channel endpoints for anomalous activity patterns.
Review remote cluster trust relationships periodically and remove federations that are no longer required.

How to Mitigate CVE-2026-28759

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.5.1, 11.4.3, or 10.11.13 as published in the Mattermost Security Updates advisory.
Inventory all configured remote clusters and disable any that are not strictly required for business operations.
Review recent membership removal events in private channels and restore impacted users where appropriate.

Patch Information

Mattermost has released fixed versions addressing MMSA-2026-00576. Administrators should consult the Mattermost Security Updates page for the specific patched build numbers corresponding to their deployment branch and apply the upgrade following the standard Mattermost upgrade procedure.

Workarounds

Disable the shared channels feature until the server is upgraded if federation is not essential.
Restrict network reachability of the federation endpoint to trusted remote clusters only via firewall or reverse proxy rules.
Audit and prune the remote cluster trust list to minimize exposure to untrusted federation peers.

bash

# Example: restrict federation endpoint to known remote clusters at the proxy layer
location /api/v4/remotecluster/ {
    allow 203.0.113.10;   # trusted remote cluster A
    allow 198.51.100.20;  # trusted remote cluster B
    deny all;
    proxy_pass http://mattermost_upstream;
}