medium advisory October 29, 2026

Mattermost Server: Security policy bypass (CVE-2026-93851)

A security policy bypass vulnerability in Mattermost Server could allow an attacker to circumvent configured server security policies.

Triage facts

Revision 1

Applicability: Mattermost Server (11.7.x < 11.7.11, 11.8.x < 11.8.6, 11.9.x < 11.9.2)
Evidence: Unknown
Severity: Medium
Action: Elevated
Sources: 3 public sources
Freshness: Revision 1Oct 29, 18:36 UTC
Vulnerabilities: 1 CVE
Source quality: A1Roughly even chance

A security policy bypass vulnerability has been identified in Mattermost Server. The vulnerability is tracked as CVE-2026-93851 and impacts specific versions of the 11.7.x, 11.8.x, and 11.9.x branches. The vulnerability allows an attacker to circumvent security policies configured on the server instance.

Impact

The vulnerability allows for the bypass of security policies enforced on the Mattermost Server, which may lead to unauthorized access or the circumvention of intended access controls.

Recommendation

Upgrade Mattermost Server installations to the patched versions as specified by the vendor in MMSA-2026-00742.
Patch affected versions:
11.7.x to 11.7.11 or later
11.8.x to 11.8.6 or later
11.9.x to 11.9.2 or later
Monitor audit logs for anomalous administrative or access control modification events that do not correlate with known administrator activity.

Immediate actions

Upgrade Mattermost Server instances to the versions specified in MMSA-2026-00742 to resolve CVE-2026-93851.

IT Operations 48h

Threat Hunt

Audit Mattermost logs for unexpected changes to role-based access control or security configuration settings.

medium medium confidence hunt now

Data: Mattermost application audit logs

Mitigations

Patch affected Mattermost Server deployments to 11.7.11, 11.8.6, 11.9.2 or later.

immediate IT Operations

CVE-2026-93851