CVE-2026-10542

Executive Summary

CVE-2026-10542 is an authorization bypass vulnerability in Mattermost, affecting versions 11.9.x through 11.9.0, 11.8.x through 11.8.4, 11.7.x through 11.7.7, and 10.11.x through 10.11.22. The flaw resides in the channel action update endpoint, which fails to validate channel action ownership, allowing a user with channel manager privileges to modify channel actions belonging to other channels they do not administer. The vulnerability carries a CVSS 3.1 base score of 5.0 (Medium) and, as of this writing, remains unpatched per available tracking sources, with no public proof-of-concept or exploit code in circulation.

Technical Analysis

CVE-2026-10542 is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The defining characteristic of this weakness class is that an application exposes an object reference — typically an identifier passed by the client — and relies on that client-supplied value to select which object to operate on, without independently verifying that the requesting principal actually owns or is authorized to act upon the referenced object.

In this specific case, the affected component is the channel action update endpoint within Mattermost. Mattermost supports "channel actions" as a feature, and the update endpoint accepts a request that references one or more channel actions. According to the NVD description, the server "fail[s] to validate channel action ownership." This means the endpoint performs the requested update operation while trusting the caller's supplied action identifier (or the associated channel context) rather than cross-checking that the action belongs to a channel under the caller's administrative control.

The authorization model is effectively broken at the object level. An authenticated user who holds the "channel manager" role is legitimately entitled to manage actions within the channels they administer. However, because ownership validation is absent, that same user can direct update requests at actions that belong to channels outside their administrative scope. The privilege boundary — the separation between one channel's administrative domain and another's — is not enforced server-side at the point of update.

Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L), the attack is network-reachable, requires low privileges (the channel manager role), requires no user interaction, and results in low confidentiality, integrity, and availability impact. The High Attack Complexity (AC:H) subscores reflect that exploitation depends on conditions such as knowledge or enumeration of valid action identifiers in other channels and successful crafting of requests against the endpoint — it is not a trivial, single unauthenticated request.

It is important to note the constraints of the available data. The NVD description does not disclose the exact URL path, request method, parameter names, or the underlying code function that performs the update. No such implementation specifics should be assumed. The vulnerability class (object-level authorization failure / IDOR-style access control bypass) and the affected surface (channel action update endpoint, invoked by channel managers) are the defensible technical facts.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class (CWE-639) and the described affected component.

1. Reconnaissance / target identification. The attacker is an authenticated Mattermost user who has been granted the channel manager role in at least one channel. The attacker identifies a target instance running an affected version (11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, or 10.11.x ≤ 10.11.22). Because the endpoint is part of the normal channel-action management feature, the attacker can observe legitimate update requests their own client issues for channels they control, revealing the request structure and the identifier format used to reference channel actions.

2. Triggering the flaw class. The authorization bypass is triggered by submitting an update request to the channel action update endpoint that references an action belonging to a channel the attacker does not administer. Because the server "fail[s] to validate channel action ownership," the request is processed against the target action rather than rejected on the basis of ownership mismatch. The client-controlled object reference is the pivot: the attacker substitutes an out-of-scope action identifier in place of one they are entitled to manage.

3. Payload / execution method (class level). At the vulnerability-class level, the "payload" is a crafted, authenticated API request carrying an object reference (action identifier) that points outside the attacker's authorization domain. No specific parameter names, endpoints, or code paths are asserted here because the advisory does not disclose them. The attack requires low privileges (PR:L) and no user interaction (UI:N); the elevated complexity (AC:H) reflects the need to determine a valid out-of-scope reference.

4. Post-exploitation impact. Successful exploitation permits unauthorized modification of channel actions in other channels, corresponding to the Low Integrity impact (I:L) in the CVSS vector. In a collaboration platform, actions are automation triggers bound to channel workflow; tampering with them can alter or disrupt channel behavior visible to other users, yielding the Low Availability (A:L) and Low Confidentiality (C:L) components (e.g., actions that surface or route content). The scope is unchanged (S:U) — impact is confined to the Mattermost authorization domain. The effect is cross-tenant/cross-channel administrative tampering rather than full system compromise.

Impact Assessment

The vulnerability enables horizontal privilege abuse within a Mattermost deployment: a channel manager can reach beyond their administrative boundary to alter channel actions in channels they do not own. Per CVSS 3.1, the base score is 5.0 (Medium), with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L.

• Confidentiality (Low): cross-channel action manipulation may indirectly expose or misroute content depending on how actions are configured.
• Integrity (Low): the core impact — unauthorized modification of channel action definitions in foreign channels.
• Availability (Low): altered or broken actions can disrupt channel automation for other users.
• Scope: Unchanged — the compromise does not cross a security authority boundary beyond the application.

Blast radius is bounded by the number of channels and channel managers on the instance and by the privileges that channel actions confer. Organizations running self-hosted or cloud Mattermost in the affected version ranges should treat internal channel managers as the threat actor population — this is a lower-privileged insider or compromised-account scenario, not an anonymous external attack. Business impact centers on workflow integrity, potential disruption of automated channel behavior, and erosion of the assumed isolation between administrative domains within a single deployment.

Detection Guidance

Sigma Rule

title: Mattermost Channel Action Update Authorization Bypass (CVE-2026-10542)
id: 9f2a1c74-1054-4d42-9b6e-000010542026
status: experimental
description: Detects use of the Mattermost channel action update endpoint, which may indicate exploitation of an ownership-validation flaw allowing channel managers to modify actions in other channels.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-10542
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: mattermost
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/actions'
      - 'channel_action'
  selection_method:
    cs-method: 'PUT'
  selection_update:
    cs-uri-stem|contains: 'update'
  condition: selection_endpoint and (selection_method or selection_update)
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate channel managers updating actions in their own channels
level: low
tags:
  - attack.t1190
  - cve.2026.10542

YARA Rule

rule CVE_2026_10542_Mattermost_Action_Update
{
    meta:
        description = "Detects references to Mattermost channel action update handling associated with CVE-2026-10542 ownership validation bypass"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-10542"
        date = "2026-01-01"
        cve = "CVE-2026-10542"

    strings:
        $s1 = "channel action update" nocase
        $s2 = "MMSA-2026-00692" ascii
        $s3 = "updateChannelAction" nocase
        $s4 = "channel_action" nocase

    condition:
        any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-10542 Mattermost Channel Action Update Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"action"; nocase; http.uri; content:"update"; nocase; reference:cve,2026-10542; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-10542; classtype:attempted-user; sid:2026105420; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "PUT" and
    url.path : "*action*" and url.path : "*update*" ]

Splunk SPL Query

index=web sourcetype=mattermost OR sourcetype=access_combined
| search (uri_path="*action*" OR uri="*action*") (uri_path="*update*" OR uri="*update*") method=PUT
| stats count values(uri_path) as paths by src_ip, user
| where count >= 1

Wazuh OSSEC Rule

<group name="mattermost,web,">
  <rule id="20261054" level="6">
    <decoded_as>web-accesslog</decoded_as>
    <match>action</match>
    <match>update</match>
    <description>CVE-2026-10542: Possible Mattermost channel action update authorization bypass (cross-channel action modification attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_10542,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix and no workaround are currently identified. Advisory reference: MMSA-2026-00692.

1. Immediate mitigations. Reduce the attack surface and the population of potential abusers. Audit and minimize the number of users holding the channel manager role across all channels; the flaw requires this role to exploit. Where channel actions are not essential, disable or restrict their use. Enforce strict monitoring of the channel action update endpoint for cross-channel activity (see Detection Guidance) and alert on requests referencing actions outside the caller's administered channels. If feasible, apply an authorization layer at the reverse proxy or API gateway that rejects channel-action update calls unless the caller's channel scope can be independently verified.

2. Patch/upgrade steps. Continue to track the vendor advisory MMSA-2026-00692 and the NVD entry for CVE-2026-10542 for an official fixed release. Once a patched version superseding the affected ranges (11.9.0, 11.8.4, 11.7.7, 10.11.22) is published, upgrade immediately. Because no patched version is currently available, do not assume an upgrade resolves the issue until the vendor confirms it.

3. Long-term hardening. Enforce server-side, object-level authorization for all channel-scoped operations — the update endpoint must verify that the authenticated principal owns or administers the specific action being modified, independent of client-supplied identifiers (the CWE-639 remediation pattern). Adopt least-privilege role assignment, centralize and routinely audit authorization logic for channel actions, and integrate authorization-bypass regression tests into CI. Maintain continuous CVE monitoring for Mattermost releases and subscribe to vendor security advisories.

References

• NVD — CVE-2026-10542: https://nvd.nist.gov/vuln/detail/CVE-2026-10542
• Mattermost Advisory — MMSA-2026-00692 (vendor advisory ID referenced in the NVD description)
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog: NOT listed (no known exploitation in the wild)

Threat actor campaigns: No known threat actor campaigns or in-the-wild exploitation evidence exists for CVE-2026-10542 as of this report. EPSS is 0.00129 (2.9th percentile), indicating low predicted exploitation likelihood, and no public PoC, Nuclei template, or exploit code has been observed. Threat model should focus on authenticated insiders or compromised channel-manager accounts within affected Mattermost deployments.