CVE-2026-10542

Mattermost versions 11.9.0 and earlier in the 11.9.x, 11.8.x, 11.7.x, and 10.11.x series are vulnerable due to insufficient validation of channel action ownership, enabling channel managers to modify actions in channels they do not own through the channel action update endpoint. This flaw could lead to unauthorized changes and potential data integrity issues within the platform. Organizations using affected Mattermost versions should prioritize patching to mitigate the risk of unauthorized access and action manipulation.