CVE-2026-4053

published 2026-05-15

CVE-2026-4053: Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I L A N

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

Affected

6 ranges

Vendor	Product	Version range	Fixed in
github.com	mattermost_mattermost-server	>= 0.0.0-20250731163400-5b955468ea1e < 0.0.0-20260414103857-b21ef302025e	0.0.0-20260414103857-b21ef302025e
github.com	mattermost_mattermost-server	>= 11.5.0 < 11.5.2	11.5.2
mattermost	mattermost	10.11.0 – 10.11.13	—
mattermost	mattermost	11.5.0 – 11.5.1	—
mattermost	mattermost_server	>= 10.11.0 < 10.11.14	10.11.14
mattermost	mattermost_server	>= 11.5.0 < 11.5.2	11.5.2

CWE-672