CVE-2026-4053: Mattermost Server Auth Bypass Vulnerability

CVE-2026-4053 Overview

CVE-2026-4053 affects Mattermost Server versions 11.5.x <= 11.5.1 and 10.11.x <= 10.11.13. The flaw exists because the server fails to enforce the PostEditTimeLimit on non-message post fields. An authenticated user can modify file attachments, props, and pin status on a post after the configured edit window has expired. The bypass occurs through the post patch and update API endpoints. Mattermost tracks this issue as advisory MMSA-2026-00631. The vulnerability is categorized under [CWE-672] Operation on a Resource after Expiration or Release.

Critical Impact
Authenticated users can alter post attachments, props, and pin status indefinitely, undermining message integrity controls that administrators rely on to enforce edit-window policies.

Affected Products

Mattermost Server 11.5.0 through 11.5.1
Mattermost Server 10.11.0 through 10.11.13
Mattermost mattermost_server component (post patch and update API endpoints)

Discovery Timeline

2026-05-15 - CVE-2026-4053 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-4053

Vulnerability Analysis

Mattermost enforces a server-side configuration called PostEditTimeLimit that restricts how long a post can be modified after creation. The check is intended to apply across all post mutation paths exposed by the REST API. In the affected releases, the enforcement logic only covers the textual message field of a post. Other mutable fields including file attachments, props, and pin status pass through the post patch and update endpoints without the time-limit check.

The vulnerability falls under the business logic and broken access control category. It is not a memory safety or injection issue. It is an authorization gap tied to a time-bounded operation on a resource. An authenticated user with normal posting privileges can exploit it. No elevated role is required, and the integrity impact is limited to post metadata rather than confidentiality or availability.

Root Cause

The root cause is incomplete enforcement of an expiration policy. The PostEditTimeLimit validation runs against the post body but is not applied uniformly to the patch and update handlers when those handlers receive changes to attachments, props, or pin state. This matches the [CWE-672] pattern of operating on a resource after its valid window has expired.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An authenticated user crafts an API request to the post patch endpoint or the post update endpoint, supplying modifications to file_ids, props, or is_pinned for a post older than PostEditTimeLimit. The server accepts the change despite the elapsed window. Refer to the Mattermost Security Updates advisory for endpoint specifics. No verified proof-of-concept code is publicly available.

Detection Methods for CVE-2026-4053

Indicators of Compromise

API calls to post patch or update endpoints targeting post IDs whose create_at timestamp is older than the configured PostEditTimeLimit value.
Audit log entries showing modifications to file_ids, props, or is_pinned without a corresponding message change on aged posts.
Unexpected changes in pinned-post inventories within channels governed by retention or compliance policies.

Detection Strategies

Correlate Mattermost audit logs with post creation timestamps to flag attachment, prop, or pin changes that occur outside the edit window.
Alert on repeated PUT or PATCH requests to /api/v4/posts/{post_id} and /api/v4/posts/{post_id}/patch from a single user against multiple aged posts.
Baseline normal post-edit behavior per user and surface deviations involving non-message fields.

Monitoring Recommendations

Forward Mattermost server and audit logs to a centralized log platform with retention sufficient to reconstruct post mutation history.
Monitor channels with compliance, legal, or incident-response significance for late-stage pin or attachment changes.
Track API error rates and 200 responses on post mutation endpoints to detect scripted abuse.

How to Mitigate CVE-2026-4053

Immediate Actions Required

Upgrade Mattermost Server to a release that supersedes 11.5.1 on the 11.5.x branch or 10.11.13 on the 10.11.x branch as published by the vendor.
Review audit logs for post mutations to non-message fields on aged posts and validate them against business expectations.
Restrict API token issuance and review which integrations have permission to patch or update posts.

Patch Information

Mattermost has published fixed builds under advisory MMSA-2026-00631. Administrators should consult the Mattermost Security Updates page for the exact remediated versions and apply them following the vendor's upgrade procedure. The fix extends the PostEditTimeLimit check across all post mutation paths, including attachments, props, and pin status.

Workarounds

No vendor-supplied workaround replaces the patch; upgrade is the supported remediation.
Where immediate upgrade is not possible, tighten channel-level posting permissions and disable integrations that automate post editing.
Increase audit log review frequency and pair it with channel ownership controls to detect after-the-fact tampering.

bash

# Configuration example: verify the configured edit window and current version
curl -H "Authorization: Bearer $TOKEN" \
  https://mattermost.example.com/api/v4/config | \
  jq '.ServiceSettings.PostEditTimeLimit'

curl https://mattermost.example.com/api/v4/system/ping?get_server_status=true