Vulnerability Details CVE-2026-27659
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to properly validate CSRF tokens in the /api/v4/access_control_policies/{policy_id}/activate endpoint, which allows an attacker to trick an admin into changing access control policy active status via a crafted request.. Mattermost Advisory ID: MMSA-2026-00578
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 6.4%
CVSS Severity
CVSS v3 Score 4.6
References
Products affected by CVE-2026-27659
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.2.0
-
cpe:2.3:a:mattermost:mattermost_server:11.2.1
-
cpe:2.3:a:mattermost:mattermost_server:11.2.2
-
cpe:2.3:a:mattermost:mattermost_server:11.3.0
-
cpe:2.3:a:mattermost:mattermost_server:11.3.1
-
cpe:2.3:a:mattermost:mattermost_server:11.4.0