CVE-2026-4053

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

Scoring

Severity

LOW

CVSS base score

3.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS probability

0.17%

CWE

CWE-672

Published

2026-05-15

Last modified

2026-05-15

Affected products

• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost
• Mattermost Mattermost

Weakness type

• CWE-672

Related vulnerabilities

• CVE-2026-53637 — Sylius: Cart FormComponent allows modification or deletion of an already-completed order
• CVE-2026-55250 — Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches
• CVE-2026-61699 — nebula-mesh: Certificate revocation is never enforced at the mesh
• CVE-2026-85044 — Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a...
• CVE-2026-19538 — Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS
• CVE-2026-79010 — Operation on a resource after expiration or release in Network in Google Chrome prior to...
• CVE-2026-44725 — EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution
• CVE-2026-52733 — ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Markdown version · Browse all CVEs