4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28759

CVE-2026-28759: Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28759

CVE-2026-28759:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260216150504-8738f8c4b3d4	8.0.0-20260216150504-8738f8c4b3d4
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260216150504-8738f8c4b3d4	5.3.2-0.20260216150504-8738f8c4b3d4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a malicious remote Mattermost cluster to remove any user from any shared channel, including private ones. This is due to a lack of authorization checks when processing membership synchronization messages from remote clusters.

The root cause is in the sharedchannel service, specifically in how it handles membership changes received from other clusters. The function onReceiveMembershipChanges is the entry point for these messages. It iterates over the received changes and calls either processMemberAdd or processMemberRemove.

Prior to the patch, the processMemberRemove function would proceed to remove a user from a channel without verifying that the remote cluster sending the request was authorized to do so. It did not check if the user being removed actually belonged to the remote cluster making the request. A malicious actor could craft a SyncMsg to remove arbitrary users from channels, leading to a denial of service for those users.

The fix, as seen in commit 8738f8c4b3d4, introduces checks in both processMemberRemove and processMemberAdd. The patched code now fetches the user object and compares its RemoteId with the RemoteId of the cluster that sent the sync message. If they do not match, the operation is aborted. This ensures that a remote cluster can only manage the membership of its own users in shared channels, effectively mitigating the vulnerability.

Vulnerable functions

sharedchannel.Service.onReceiveMembershipChanges

server/platform/services/sharedchannel/membership_recv.go

This function receives and processes membership change synchronization messages from remote clusters. It iterates through the changes and calls `processMemberAdd` or `processMemberRemove`. The vulnerability lies in the lack of validation before calling these sub-functions, allowing malicious messages to be processed.

sharedchannel.Service.processMemberRemove

server/platform/services/sharedchannel/membership_recv.go

This function is directly responsible for processing a request to remove a user from a shared channel. The vulnerability is that it previously did not verify that the remote cluster making the request had the authority to remove the specified user. A malicious remote cluster could exploit this to remove any user from any channel it knew about.

sharedchannel.Service.processMemberAdd

server/platform/services/sharedchannel/membership_recv.go

While the CVE description focuses on member removal, the patch also adds authorization checks to `processMemberAdd`. This indicates a similar vulnerability where a remote cluster could add users that did not belong to it into a channel. The function was vulnerable to misuse by a malicious remote cluster.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.