CVE-2026-27769: Mattermost doesn't validate whether users were correctly owned by the correct Connected Workspace

April 17, 2026 (updated April 28, 2026)

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API. Mattermost Advisory ID: MMSA-2026-00603.

References

github.com/advisories/GHSA-mxxh-fmjq-j6x4
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-27769

Code Behaviors & Features

Detect and mitigate CVE-2026-27769 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →