CVE-2026-18799 Mattermost CVE debrief

Who should care

Mattermost administrators and team admins should assess exposure and verify affected instances. They should also restrict team admin privileges and monitor for suspicious activities. Additionally, security teams and operators managing Mattermost deployments should review the advisory and apply patches or mitigations as necessary.

Why it matters

CVE-2026-18799 allows attackers to manipulate Mattermost teams and user identities via Slack imports, requiring prompt verification and mitigation by Mattermost administrators and team admins.

• Team admins can be tricked into adding arbitrary users to their teams
• Attackers can forge posts from legitimate users' identities
• Requires verification of affected Mattermost versions and configurations
• Restricting team admin privileges can mitigate the vulnerability

Technical summary

Mattermost fails to restrict Slack import account binding to system administrator-initiated imports, allowing an authenticated attacker with team admin privileges to force-add existing Mattermost users to their team and forge posts attributed to those users' identities via a crafted Slack export containing target users' email addresses. This issue affects multiple versions of Mattermost, including 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5. The vulnerability highlights the importance of restricting team admin privileges and verifying affected instances.

Defensive priority

Defenders should prioritize verifying affected Mattermost instances and restricting team admin privileges.

Recommended defensive actions

• Verify affected Mattermost instances and apply vendor patches
• Restrict team admin privileges to prevent unauthorized user additions
• Monitor for suspicious Slack import activities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from Mattermost Advisory ID: MMSA-2026-00757 and CVE Program record indicates Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 are affected. The advisory provides details on the vulnerability and recommends verifying affected instances and applying patches. The CVE Program record offers additional metadata on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.