CVE-2026-27769
LOW2.7EPSS 0.04%Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace
Published: 4/17/2026Modified: 5/5/2026
Also known as:GHSA-mxxh-fmjq-j6x4
Description
Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API. Mattermost Advisory ID: MMSA-2026-00603.
Affected packages (1)
- Go/github.com/mattermost/mattermost-server>= 8.0.0-20250721062209-4952acea88ce, < 8.0.0-20260316060126-bc1a2b34b1f9
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | LOW2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |