CVE-2026-27659: 
vulnerability analysis and mitigation

CVE-2026-27659 is a Cross-Site Request Forgery (CSRF) vulnerability in Mattermost Server that allows an attacker to trick an authenticated administrator into changing access control policy active status via a crafted request. The flaw exists in the /api/v4/access_control_policies/{policy_id}/activate endpoint due to improper CSRF token validation. Affected versions include Mattermost Server 10.11.x ≤ 10.11.10, 11.2.x ≤ 11.2.2, 11.3.x ≤ 11.3.1, and 11.4.x ≤ 11.4.0. It was published on March 25, 2026, with patches released shortly after. The CVSS v3.1 base score is 4.6 (Medium) (Mattermost Advisory, Red Hat CVE).

The root cause is improper CSRF token validation (CWE-352) on the /api/v4/access_control_policies/{policy_id}/activate API endpoint in Mattermost Server. An attacker can craft a malicious HTTP request that, when triggered by an authenticated administrator (e.g., via a phishing link or compromised webpage), causes the server to activate or deactivate an access control policy without the admin's knowledge. Exploitation requires the attacker to have at least low-level authenticated access and to socially engineer an administrator into interacting with the crafted request. No public proof-of-concept exploit code has been identified (Mattermost Advisory, ENISA EUVD).

Successful exploitation allows an attacker to manipulate access control policies on vulnerable Mattermost instances — specifically activating or deactivating policies that govern authentication and authorization controls — without the administrator's knowledge or consent. This can degrade the security posture of the Mattermost deployment by altering who has access to what resources, potentially enabling unauthorized access or privilege escalation for other users. Confidentiality and integrity are both assessed as low-impact; availability is not affected (ENISA EUVD, Mattermost Advisory).

1. Reconnaissance: Identify a target Mattermost instance running a vulnerable version (10.11.x ≤ 10.11.10, 11.2.x ≤ 11.2.2, 11.3.x ≤ 11.3.1, or 11.4.x ≤ 11.4.0) and determine the policy_id of the target access control policy (e.g., via API enumeration with a low-privileged account).
2. Craft malicious request: Construct a forged HTTP request targeting the /api/v4/access_control_policies/{policy_id}/activate endpoint, designed to activate or deactivate the specified policy. Because CSRF token validation is absent or improper, the server will accept the request if it originates from an authenticated admin session.
3. Social engineering: Embed the crafted request in a malicious webpage, email link, or image tag that will be triggered when an authenticated Mattermost administrator visits or interacts with it (e.g., via a phishing email).
4. Policy manipulation: When the administrator's browser executes the forged request, the Mattermost server processes it using the admin's session credentials, activating or deactivating the targeted access control policy without the admin's intent.
5. Leverage outcome: With access control policies altered, the attacker may exploit the changed authorization state to gain broader access or reduce security controls for subsequent attacks (Mattermost Advisory, ENISA EUVD).

• Logs: Mattermost server audit logs showing unexpected POST/PUT requests to /api/v4/access_control_policies/{policy_id}/activate from an administrator account, particularly at unusual times or from unfamiliar IP addresses.
• Logs: Access control policy state changes (activation/deactivation events) that do not correspond to known administrative actions or change management records.
• Network: HTTP requests to the activate endpoint originating from browser-based sessions (Referer headers pointing to external or unexpected domains), which may indicate CSRF exploitation.
• Behavioral: Administrator accounts showing policy change activity without corresponding support tickets, change requests, or acknowledgment from the admin themselves.

Mattermost has released patched versions addressing this vulnerability: users should upgrade to 10.11.11, 11.2.3, 11.3.2, or 11.4.1 or later. As interim mitigations, administrators should implement SameSite cookie attributes to reduce CSRF risk, restrict access to the /api/v4/access_control_policies endpoint to trusted networks, and require additional authentication factors for sensitive policy changes. Administrators should also be educated about CSRF-based phishing attacks to reduce the likelihood of social engineering success (Mattermost Advisory, ENISA EUVD).

The vulnerability was noted in automated CVE tracking feeds and the ENISA European Vulnerability Database shortly after disclosure. No significant vendor statements beyond the Mattermost security advisory, notable researcher commentary, or major media coverage have been identified for this moderate-severity issue (ENISA EUVD).