3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4053

CVE-2026-4053: Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints. Mattermost Advisory ID: MMSA-2026-00631.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4053

CVE-2026-4053:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 11.5.0, < 11.5.2	11.5.2
github.com/mattermost/mattermost-server	go	>= 0.0.0-20250731163400-5b955468ea1e, < 0.0.0-20260414103857-b21ef302025e	0.0.0-20260414103857-b21ef302025e

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-hw87-6jcq-9f8q, allowed authenticated users to bypass the PostEditTimeLimit for non-message fields in Mattermost posts. This meant that while the message of a post could not be edited after the configured time limit, other attributes such as file attachments, properties (props), and the pinned status could still be modified. This occurred because the API endpoints responsible for updating posts did not consistently enforce the time limit across all mutable fields.

The analysis of the patch, specifically commit abc3ec4eedddf1c37900f3b8c154b9749635177e, reveals the exact locations of the vulnerability. The functions updatePost, patchPost, saveIsPinnedPost, and restorePostVersion in server/channels/api4/post.go were all found to have incomplete or missing time limit checks.

updatePost and patchPost only checked the time limit if the message of the post was being changed.
saveIsPinnedPost had no time limit check at all, allowing posts to be pinned or unpinned indefinitely.
restorePostVersion only considered the message when checking permissions, allowing other attributes to be changed by restoring a previous version.

The patch rectifies these issues by introducing a new helper function, postEditTimeLimitExpired, and applying it consistently across all the vulnerable functions. The checks are expanded to cover not just the message, but also FileIds, Props, and IsPinned status, ensuring that no part of a post can be modified after the edit time limit has expired. Any attempt to do so will now result in a permissions_time_limit.app_error.

Vulnerable functions

updatePost

server/channels/api4/post.go

The vulnerability lies in the `updatePost` function, which, prior to the patch, only checked the `PostEditTimeLimit` for changes to the `message` field. This allowed an attacker to modify other post attributes like `FileIds`, `Props`, and `IsPinned` after the editing time limit had expired. The patch extends the check to include these other attributes, thus mitigating the vulnerability.

patchPost

server/channels/api4/post.go

Similar to `updatePost`, the `patchPost` function was vulnerable because it only enforced the `PostEditTimeLimit` when the `message` field was being patched. This allowed modifications to other fields outside the allowed time window. The fix introduces a comprehensive check on all fields in the `PostPatch` object.

saveIsPinnedPost

server/channels/api4/post.go

The `saveIsPinnedPost` function, which handles pinning and unpinning of posts, completely lacked a `PostEditTimeLimit` check. This meant a user could pin or unpin any post at any time, regardless of its age. The patch adds the necessary time limit check to prevent this.

restorePostVersion

server/channels/api4/post.go

The `restorePostVersion` function was vulnerable because it only considered the `message` field when checking the edit time limit. This allowed an attacker to restore a post to a previous version with different file attachments or other properties after the edit window had closed. The patch ensures that all relevant fields are checked by passing a complete `PostPatch` object to the `postPatchChecks` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.