CVE-2026-6062: Mattermost doesn't validate channel ownership of an existing subscription before applying edits

June 22, 2026 (updated September 15, 2026)

Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription before applying edits which allows an authenticated attacker to hijack subscriptions from channels they have no access to via a crafted PUT request to the subscription edit endpoint.. Mattermost Advisory ID: MMSA-2026-00650

References

github.com/advisories/GHSA-mxq2-5jpg-7474
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-6062

Code Behaviors & Features

Detect and mitigate CVE-2026-6062 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →