Vulnerability Details CVE-2026-9708
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.2%
CVSS Severity
CVSS v3 Score 4.9
References
Products affected by CVE-2026-9708
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.11
-
cpe:2.3:a:mattermost:mattermost_server:10.11.12
-
cpe:2.3:a:mattermost:mattermost_server:10.11.13
-
cpe:2.3:a:mattermost:mattermost_server:10.11.14
-
cpe:2.3:a:mattermost:mattermost_server:10.11.15
-
cpe:2.3:a:mattermost:mattermost_server:10.11.16
-
cpe:2.3:a:mattermost:mattermost_server:10.11.17
-
cpe:2.3:a:mattermost:mattermost_server:10.11.18
-
cpe:2.3:a:mattermost:mattermost_server:10.11.19
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.6.0
-
cpe:2.3:a:mattermost:mattermost_server:11.6.1
-
cpe:2.3:a:mattermost:mattermost_server:11.6.2
-
cpe:2.3:a:mattermost:mattermost_server:11.6.3
-
cpe:2.3:a:mattermost:mattermost_server:11.6.4
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0
-
cpe:2.3:a:mattermost:mattermost_server:11.7.1
-
cpe:2.3:a:mattermost:mattermost_server:11.7.2