CVE-2026-27769 LOW

CVE-2026-27769: Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Vendor Mattermost
Product Mattermost
Weakness CWE-862 · Missing authorization
Published April 15, 2026
Last update April 15, 2026
View on NVD All CVEs

CVSS base score

2.7/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API.. Mattermost Advisory ID: MMSA-2026-00603

Key dates

02Disclosure timeline

April 15, 2026 CVE published
April 15, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-29433 WordPress tencentcloud-cos plugin <= 1.0.7 - Broken Access Control vulnerability CVE-2024-54218 WordPress AIO Contact plugin <= 2.8.1 - Unauthenticated Plugin Settings Change vulnerability CVE-2026-24382 WordPress News Magazine X theme <= 1.2.50 - Broken Access Control vulnerability CVE-2026-44914 Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents CVE-2024-33558 WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability