Is CVE-2026-93847 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-93847?

CVE-2026-93847 has a CVSS v3 severity of LOW (3.5).

Back

CVE-2026-93847

Description

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.. Mattermost Advisory ID: MMSA-2026-00732