Mattermost Plugins (affected versions: <=11.5, 11.1.5, 10.13.11, and 11.3.4.0) contain an authorization weakness where plugin users can create subscriptions to groups that were not meant to be allowed (i.e., not whitelisted). The issue is caused by insufficient validation of namespaces, allowing an attacker to bypass group allowlisting by creating groups that share a prefix with a whitelisted group. Mattermost Advisory: MMSA-2026-00601.
The root cause is an improper check for “valid namespaces” when determining whether a group subscription is permitted. Instead of strictly verifying that the target group belongs to an allowed/whitelisted namespace, the logic can be tricked by creating a new group whose name shares the same prefix as a whitelisted group. Because the namespace validation relies on prefix matching rather than robust namespace boundary checks, the plugin can be induced to accept subscriptions to unauthorized groups.
In practice, an attacker with the ability to use/install or operate a Mattermost plugin (and create groups) can craft group names to collide with the whitelisted group’s prefix. Once such a group exists, the plugin’s subscription mechanism may treat it as belonging to the whitelisted namespace and allow the subscription to be created for that unauthorized group. This is an authorization bypass issue (CWE-863) rather than a memory corruption or injection flaw.
Impact is limited to unauthorized subscription behavior within the Mattermost environment: plugin users may be able to subscribe to groups that were not whitelisted, potentially leading to unintended information exposure or increased access to group-scoped content/events. The CVSS score is 4.3 (Medium) with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network reachability, low attack complexity, and low privileges required, with integrity impact but no direct confidentiality impact indicated by the provided vector. Real-world risk depends on how plugins enforce group allowlists and what data or actions are exposed through group subscriptions.
Mitigation: upgrade Mattermost Plugins to a fixed version as specified by Mattermost Advisory MMSA-2026-00601 (the provided reference content does not include exact patched version numbers). As a workaround or compensating control, administrators should review and tighten plugin group allowlisting/namespace configuration and reduce the ability of untrusted users to create groups that could share prefixes with whitelisted groups. For detection guidance, monitor for newly created groups whose names share prefixes with whitelisted groups and for plugin subscription events targeting groups that were not previously subscribed/allowed.
poc_available: false
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE-863