4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-3637

CVE-2026-3637: Mattermost doesn't check the create_post channel permission during post edit operations

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and patch endpoints.. Mattermost Advisory ID: MMSA-2026-00627

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-3637

CVE-2026-3637:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost/server/v8	go	>= 10.11.0, < 10.11.14	10.11.14
github.com/mattermost/mattermost/server/v8	go	>= 11.4.0, < 11.4.4	11.4.4
github.com/mattermost/mattermost/server/v8	go	< 8.0.0-20260316171743-090408f09f53	8.0.0-20260316171743-090408f09f53
github.com/mattermost/mattermost/server/v8	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost-server	go	< 5.3.2-0.20260316171743-090408f09f53	5.3.2-0.20260316171743-090408f09f53

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows authenticated users to edit their posts even if their permission to create posts in a channel has been revoked. This is due to a missing authorization check in the API endpoints responsible for updating and patching posts. The analysis of the provided commit 090408f09f53ffc9afc6c65c7c7c1fd3a8cd22f3 reveals that the functions updatePost and patchPost (via postPatchChecks) in server/channels/api4/post.go were modified to include a check for the create_post permission. The added code, userCreatePostPermissionCheckWithContext(c, originalPost.ChannelId), explicitly enforces this missing permission check. Therefore, updatePost and patchPost are the vulnerable functions as they were the ones that lacked the necessary authorization control, allowing the bypass.

Vulnerable functions

updatePost

server/channels/api4/post.go

The `updatePost` function is responsible for handling API requests to update a post. Before the patch, this function did not check if the user had the `create_post` permission for the channel. The patch adds the `userCreatePostPermissionCheckWithContext` call, which enforces this check. The absence of this check allowed users who had their posting privileges revoked to still edit their existing posts.

patchPost

server/channels/api4/post.go

The `patchPost` function handles API requests to partially update a post. It calls the `postPatchChecks` function to perform validation. Before the patch, `postPatchChecks` did not verify if the user had `create_post` permission. The patch adds the `userCreatePostPermissionCheckWithContext` call within `postPatchChecks`. This vulnerability allowed users without posting privileges to modify their posts via a patch request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.