CVE-2026-5163: Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

May 18, 2026 (updated June 1, 2026)

Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645

References

github.com/advisories/GHSA-8r89-8w26-cq32
github.com/mattermost/mattermost/commit/f4d1abe7e8f545f1a87f463fa9fe451c731aebf8
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-5163

Code Behaviors & Features

Detect and mitigate CVE-2026-5163 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →