CVE WATCH / VULNERABILITY DETAIL
CVE-2026-93847
LOWCVSS 3.5NVD feed
Published 26 October 2026 · tracked since 27 October 2026
Description
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-20
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog