CVE-2026-4053

Fixed in a distro release EPSS <1%CVSS 3.1

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to enforce the PostEditTimeLimit on non-message post fields which allows an authenticated user to modify post file attachments, props, and pin status after the edit window has expired via the post patch and update API endpoints.. Mattermost Advisory ID: MMSA-2026-00631

Published 2026-05-15 · CVE record · OSV

Products: Mattermost

Fixed upstream

Ecosystem	Package	Fixed in
Go	github.com/mattermost/mattermost-server	11.5.2
Go	github.com/mattermost/mattermost-server	0.0.0-20260414103857-b21ef302025e
Go	github.com/mattermost/mattermost-server	11.5.2+incompatible

Distro releases

Release	Package	Fixed in
openSUSE:Leap 16.0	govulncheck-vulndb	0.0.20260723T184607-160000.1.1