---
id: CVE-2026-93847
title: Improper post type validation on scheduled post endpoints
summary: >-
  Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post
  types on the scheduled post creation and publication paths which allows an
  authenticated channel member to publish messages rendering as trusted system
  events vi…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Mattermost
product: Mattermost
affected:
  - Mattermost >= 11.7.0 <= 11.7.10
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:15:12.711Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-93847'
references:
  - url: 'https://mattermost.com/security-updates'
    label: MMSA-2026-00732
tags:
  - cve.org
ingestedAt: '2026-10-26T15:29:30.539Z'
---

## Overview

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732

## Affected

- `Mattermost >= 11.7.0 <= 11.7.10`

## Remediation

Update Mattermost to versions 11.11.0, 11.7.11 or higher.