CVE-2026-4635: Mattermost doesn't archive the channel before removing persistent notifications

May 26, 2026 (updated June 26, 2026)

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications which allows authenticated user to crash the server via timing the creation of persistent notification message between the server deleting existing persistent notifications and archiving the channel. Mattermost Advisory ID: MMSA-2026-00637.

References

github.com/advisories/GHSA-pg7c-462j-grxv
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-4635

Code Behaviors & Features

Detect and mitigate CVE-2026-4635 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →