{"id":"EUVD-2026-30753","enisaUuid":"2e8919cd-9e3f-3ea5-88d3-a06920b2a49b","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645","datePublished":"May 18, 2026, 8:11:13 AM","dateUpdated":"May 18, 2026, 2:40:03 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-5163\nGHSA-8r89-8w26-cq32\n","assigner":"Mattermost","epss":0.21,"enisaIdProduct":[{"id":"c61abd96-c335-30b8-aa25-a9b28950448f","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"enisaIdVendor":[{"id":"3e671620-8358-34ba-aa98-521549ded7f1","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"44c3a824-ef0f-39ec-9e18-2b60704f6e5e","vulnerability":{"id":"GHSA-8r89-8w26-cq32","description":"Mattermost doesn\u0027t verify channel membership when processing AI-assisted message rewrites","datePublished":"May 18, 2026, 9:31:48 AM","dateUpdated":"Jun 1, 2026, 3:27:00 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-5163\nhttps://github.com/mattermost/mattermost/commit/f4d1abe7e8f545f1a87f463fa9fe451c731aebf8\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30753\n","aliases":"CVE-2026-5163\nGHSA-8r89-8w26-cq32\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"aa5eb707-ff50-3861-8249-1752acdf65e9","vulnerability":{"id":"CVE-2026-5163","description":"Mattermost versions 11.5.x \u003c\u003d 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.. Mattermost Advisory ID: MMSA-2026-00645","datePublished":"May 18, 2026, 8:11:13 AM","dateUpdated":"May 18, 2026, 2:40:03 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-30753\n","assigner":"Mattermost","epss":0.21,"dataProcessed":"Nov 5, 2026, 7:17:24 AM","vulnerabilityProduct":[{"id":"2d6f2e06-e704-3fd2-8239-2a44cc84b3d0","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.5.0 ≤11.5.1"}],"vulnerabilityVendor":[{"id":"7409bda5-c838-3548-b1f5-46156a6eb13b","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[]}