---
id: CVE-2026-28759
title: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3
  fail to validate that a remote cluster has access to a channel before
  processing membership removal requests during shared channel membership sync,
  which allows …
summary: >-
  Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3
  fail to validate that a remote cluster has access to a channel before
  processing membership removal requests during shared channel membership sync,
  which allows …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: mattermost
product: mattermost_server
affected:
  - 'mattermost_server >= 10.11.0, < 10.11.14'
  - 'mattermost_server >= 11.4.0, < 11.4.4'
  - 'mattermost_server >= 11.5.0, < 11.5.2'
patched:
  - mattermost_server 11.5.2
published: '2026-05-18'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-28759'
references:
  - url: 'https://mattermost.com/security-updates'
    label: responsibledisclosure@mattermost.com
tags:
  - nvd
epss: 0.00254
epssPercentile: 0.15794
ingestedAt: '2026-10-14T20:53:12.295Z'
---

## Overview

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync, which allows a malicious remote cluster to remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access. Mattermost Advisory ID: MMSA-2026-00576

## Affected

- `mattermost_server >= 10.11.0, < 10.11.14`
- `mattermost_server >= 11.4.0, < 11.4.4`
- `mattermost_server >= 11.5.0, < 11.5.2`

## Remediation

Upgrade past the affected range:

- `mattermost_server 11.5.2`