What’s Vulnerable › Vulnerabilities

CVE-2026-93847: Improper post type validation on scheduled post endpoints

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-26
• Weakness: CWE-863

Description

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

Affected products

• Mattermost: from 11.7.0 through 11.7.10

References

• https://mattermost.com/security-updates

Get alerted when CVE-2026-93847 or the next vulnerability affects your stack