CVE-2026-9708: Mattermost Server Auth Bypass Vulnerability

CVE-2026-9708 Overview

CVE-2026-9708 is an authorization bypass vulnerability in Mattermost Server that allows a user with webhook management permissions to impersonate other users. The flaw exists because Mattermost fails to validate that an assigned incoming webhook user has access to the target team or channel. An attacker with the required permissions can craft webhook configurations and payloads to create posts or direct messages attributed to another user. The issue is tracked under Mattermost Advisory ID MMSA-2026-00683 and is categorized as an authorization flaw [CWE-639].

Critical Impact
A privileged user can post messages and direct messages as any other user, enabling impersonation, social engineering, and integrity attacks on team communications.

Affected Products

Mattermost Server 11.7.x versions <= 11.7.2
Mattermost Server 11.6.x versions <= 11.6.4
Mattermost Server 10.11.x versions <= 10.11.19

Discovery Timeline

2026-07-13 - CVE-2026-9708 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-9708

Vulnerability Analysis

CVE-2026-9708 stems from missing authorization checks in Mattermost's incoming webhook subsystem. Incoming webhooks in Mattermost are configured with an associated user identifier, and messages delivered via the webhook are posted under that user's identity. The server does not verify that the assigned user belongs to the target team or has access to the target channel. A requester with webhook management permissions can therefore configure a webhook that impersonates another user across team and channel boundaries.

Exploitation results in high-integrity impact without requiring authentication as the impersonated user. The attacker gains the ability to author posts and direct messages that appear to originate from another account. This undermines message provenance, enables phishing within a trusted channel, and can be used to trigger workflows that rely on message authorship.

Root Cause

The root cause is an authorization gap between the webhook configuration layer and the team/channel access control layer. The affected code paths accept a user assignment for the webhook without cross-checking that user's team membership or channel permissions against the webhook target. This is a classic instance of authorization by assertion, mapped to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

The attack requires network access to the Mattermost API and an authenticated session with webhook management permissions. The attacker creates or modifies an incoming webhook, assigns it to a target user identifier, and points it at a team or channel to which the assigned user lacks access. Crafted payloads sent to the webhook endpoint then produce posts or direct messages attributed to the impersonated user. See the Mattermost Security Updates advisory for additional technical detail.

Detection Methods for CVE-2026-9708

Indicators of Compromise

Incoming webhook configurations where the assigned user_id does not match a member of the webhook's target team or channel.
Posts or direct messages authored by users who have no client session or API activity at the corresponding timestamp.
Sudden creation or modification of incoming webhooks by administrators or integration accounts outside of standard change windows.

Detection Strategies

Audit the Mattermost IncomingWebhooks table and correlate UserId with team and channel membership records to surface mismatches.
Review Mattermost audit logs for webhook_create and webhook_update events, focusing on assignments that cross team boundaries.
Alert on direct messages generated through webhook endpoints, since incoming webhooks are typically used for channel posts rather than DMs.

Monitoring Recommendations

Forward Mattermost audit and application logs to a centralized log platform and retain webhook-related events for retrospective analysis.
Track the population of accounts with manage_incoming_webhooks permission and review changes to this set.
Baseline normal webhook activity per integration and alert on deviations in author identity or destination channel.

How to Mitigate CVE-2026-9708

Immediate Actions Required

Upgrade Mattermost Server to a fixed release above 11.7.2, 11.6.4, or 10.11.19 on the corresponding release branch.
Review all existing incoming webhooks and delete any whose assigned user is not a member of the webhook's target team or channel.
Restrict the manage_incoming_webhooks permission to a minimal set of trusted administrators and integration accounts.

Patch Information

Mattermost has released patched versions addressing CVE-2026-9708 under advisory MMSA-2026-00683. Administrators should consult the Mattermost Security Updates page for the exact fixed version numbers on each supported branch and apply the upgrade following standard Mattermost upgrade procedures.

Workarounds

Disable incoming webhooks server-wide by setting EnableIncomingWebhooks to false in config.json if webhooks are not required.
Remove webhook management permissions from non-administrative roles until the patch is applied.
Rotate or delete existing webhook tokens after upgrading to invalidate any preconfigured impersonation vectors.

bash

# Configuration example: disable incoming webhooks in config.json
{
  "ServiceSettings": {
    "EnableIncomingWebhooks": false,
    "EnablePostUsernameOverride": false,
    "EnablePostIconOverride": false
  }
}