CVE-2026-27769

CVE-2026-27769 is an authentication validation flaw affecting Mattermost versions 10.11.x through 10.11.12 that allows malicious remote servers connected via the Connected Workspaces feature to manipulate the displayed status of local users through the Connected Workspaces API. The vulnerability stems from inadequate verification of user ownership across workspace boundaries, creating an integrity risk in federated deployment scenarios. The vulnerability carries a low CVSS score of 2.7 with network-based attack vector, low complexity, and high privilege requirements, limiting its practical exploitability. The impact is restricted to integrity concerns, specifically unauthorized modification of user status displays, with no confidentiality or availability impact. The EPSS score of 0.000340 indicates minimal real-world exploitation probability relative to other disclosed vulnerabilities. There is no evidence of active exploitation, and the vulnerability is not tracked on the Known Exploited Vulnerabilities catalog or active threat intelligence lists. The low severity metrics and privilege barriers appear to have generated limited community attention and exploit development. Organizations running affected versions should prioritize patching in routine maintenance cycles rather than as an emergency response.