CVE-2026-9824— Remote cluster metadata enumeration via /share-channel autocomplete
Possible ATT&CK Techniques 1AI
T1005 · Data from Local SystemGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-9824
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Remote cluster metadata enumeration via /share-channel autocomplete
Source: NVD (National Vulnerability Database)
Vulnerability Description
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-00676
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.7.0 ~ 11.7.2 | - |
II. Public POCs for CVE-2026-9824
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9824
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-07-13 · 10 CVEs total
| CVE-2026-6850 | 6.5 MEDIUM | Crafted message attachment causes client-side denial of service via markdown parser regex |
| CVE-2026-10106 | 6.5 MEDIUM | Unauthorized users can trigger interactive post actions in private channels via action coo |
| CVE-2026-9571 | 5.9 MEDIUM | Deactivated user accounts can continue to obtain valid OAuth access tokens via refresh tok |
| CVE-2026-9597 | 5.4 MEDIUM | Deactivated guest accounts can authenticate via magic-link token in Mattermost REST API lo |
| CVE-2026-10085 | 5.4 MEDIUM | Ordinary group/direct message member can enable group_constrained and remove all channel p |
| CVE-2026-9708 | 4.9 MEDIUM | Incoming webhook user attribution via unvalidated webhook owner |
| CVE-2026-6541 | 4.3 MEDIUM | Unscoped updates to other playbooks' metric configuration |
| CVE-2026-10103 | 4.3 MEDIUM | Authenticated remote cluster can modify or delete posts it does not own in Mattermost Conn |
| CVE-2026-9820 | 3.8 LOW | Mattermost schemes teams endpoint exposes private team invite IDs |
IV. Related Vulnerabilities
Same product: Mattermost
- CVE-2026-6541
Unscoped updates to other playbooks' metric configuration - CVE-2026-9820
Mattermost schemes teams endpoint exposes private team invit - CVE-2026-9597
Deactivated guest accounts can authenticate via magic-link t - CVE-2026-6850
Crafted message attachment causes client-side denial of serv - CVE-2026-10106
Unauthorized users can trigger interactive post actions in p
Same vendor: Mattermost
- CVE-2026-6541
Unscoped updates to other playbooks' metric configuration - CVE-2026-9820
Mattermost schemes teams endpoint exposes private team invit - CVE-2026-9597
Deactivated guest accounts can authenticate via magic-link t - CVE-2026-6850
Crafted message attachment causes client-side denial of serv - CVE-2026-10106
Unauthorized users can trigger interactive post actions in p
Same weakness: CWE-862
- CVE-2026-9820
Mattermost schemes teams endpoint exposes private team invit - CVE-2026-14934
Cross-Tenant Repository Takeover via Improper Access Control - CVE-2026-59523
WordPress Simply Schedule Appointments plugin <= 1.6.11.11 - - CVE-2026-61958
WordPress License Manager for WooCommerce plugin <= 3.0.17 - - CVE-2026-61983
WordPress Church Admin plugin <= 5.0.30 - Broken Access Cont
V. Comments for CVE-2026-9824
No comments yet