CVE-2026-5163
published 2026-05-18CVE-2026-5163: Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.21%
10.7th percentile
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 0 < 5.3.2-0.20260401090745-f4d1abe7e8f5 | 5.3.2-0.20260401090745-f4d1abe7e8f5 |
| github.com | mattermost_mattermost_server_v8 | >= 0 < 8.0.0-20260401090745-f4d1abe7e8f5 | 8.0.0-20260401090745-f4d1abe7e8f5 |
| github.com | mattermost_mattermost_server_v8 | >= 11.5.0 < 11.5.2 | 11.5.2 |
| mattermost | mattermost | 11.5.0 – 11.5.1 | — |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.2 | 11.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8r89-8w26-cq32: Mattermost versions 11
ghsa_unreviewed·2026-05-18
CVE-2026-5163 [MEDIUM] CWE-862 GHSA-8r89-8w26-cq32: Mattermost versions 11
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645
VulDB
Mattermost up to 11.5.1 Post Rewrite Endpoint authorization (EUVD-2026-30753)
vuldb·2026-05-18·CVSS 6.5
CVE-2026-5163 [MEDIUM] Mattermost up to 11.5.1 Post Rewrite Endpoint authorization (EUVD-2026-30753)
A vulnerability categorized as problematic has been discovered in Mattermost up to 11.5.1. This issue affects some unknown processing of the component Post Rewrite Endpoint. Executing a manipulation can lead to missing authorization.
This vulnerability is handled as CVE-2026-5163. The attack can be executed remotely. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
Mattermost doesn't verify channel membership when processing AI-assisted message rewrites
ghsa·2026-05-18
CVE-2026-5163 [MEDIUM] CWE-862 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites
Mattermost doesn't verify channel membership when processing AI-assisted message rewrites
Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-18
Published