CVE-2026-6062
published 2026-06-22CVE-2026-6062: Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription…
PriorityP341medium6.4CVSS 3.1
AVNACHPRLUINSUCHILAL
EPSS
0.24%
14.9th percentile
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.18 | 10.11.18 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.6 | 11.5.6 |
| github.com | mattermost_mattermost-server | >= 11.6.0 < 11.6.3 | 11.6.3 |
| github.com | mattermost_mattermost-server | >= 11.7.0 < 11.7.1 | 11.7.1 |
| mattermost | mattermost | 10.11.0 – 10.11.17 | — |
| mattermost | mattermost | 11.5.0 – 11.5.5 | — |
| mattermost | mattermost | 11.6.0 – 11.6.2 | — |
| mattermost | mattermost | 11.7.0 – 11.7.0 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.18 | 10.11.18 |
| mattermost | mattermost_server | >= 11.5.0 < 11.5.6 | 11.5.6 |
| mattermost | mattermost_server | >= 11.6.0 < 11.6.3 | 11.6.3 |
| mattermost | mattermost_server | >= 11.7.0 < 11.7.1 | 11.7.1 |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Mattermost doesn't validate channel ownership of an existing subscription before applying edits
ghsa·2026-06-22
CVE-2026-6062 [MEDIUM] CWE-639 Mattermost doesn't validate channel ownership of an existing subscription before applying edits
Mattermost doesn't validate channel ownership of an existing subscription before applying edits
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650
VulDB
Mattermost up to 11.7.x Subscription Edit Endpoint authorization
vuldb·2026-06-22·CVSS 6.4
CVE-2026-6062 [MEDIUM] Mattermost up to 11.7.x Subscription Edit Endpoint authorization
A vulnerability marked as problematic has been reported in Mattermost up to 10.11.17/11.5.5/11.6.2/11.7.0/11.7.x. Affected by this vulnerability is an unknown functionality of the component Subscription Edit Endpoint. This manipulation causes authorization bypass.
This vulnerability is handled as CVE-2026-6062. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authe
ghsa_unreviewed·2026-06-22
CVE-2026-6062 [MEDIUM] CWE-639 Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authe
Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650
Red Hat
coturn: Coturn: Server-Side Request Forgery and Remote Code Execution via IP address canonicalization bypass
vendor_redhat·2026-08-11·CVSS 5.8
CVE-2026-73212 [MEDIUM] CWE-1389 coturn: Coturn: Server-Side Request Forgery and Remote Code Execution via IP address canonicalization bypass
coturn: Coturn: Server-Side Request Forgery and Remote Code Execution via IP address canonicalization bypass
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.
A flaw was found in Coturn. An authenticated client using the RFC 6062 TCP CONNECT relay path can bypass intended IPv4 denied-peer-ip range restrictions due to improper canonicalization of IPv4-compatible, 6to4, and NAT64 ad
No detection rules found.
No public exploits indexed.
2026-06-22
Published