What is the CVSS score of CVE-2026-10527?

CVE-2026-10527 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Mattermost CVE-2026-10527

Q: Which versions of Mattermost are affected by CVE-2026-10527?

Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI.

EUVD-2026-60192 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-17 responsibledisclosure@mattermost.com

GHSA-ghq9-4rcg-jvc2

Authentication Bypass Mattermost Mattermost Server

6.3

CVSS 3.1 · Vendor: mattermost

Severity by source

Vendor (mattermost) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable API requires authenticated session (PR:L); stale flag exploitation is straightforward (AC:L); impact limited to Boards feature scope only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mattermost).

CVSS VectorVendor: mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 15:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691

AnalysisAI

Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI. Affected are Mattermost versions 11.7.0-11.7.6, 10.11.0-10.11.21, and 11.8.0-11.8.3, where the SchemeAdmin flag is not reconciled against the user's current role during or after demotion. An authenticated attacker in this state can invoke admin-only Boards operations - including modifying board permissions and settings - without detection by role-based access checks. No public exploit code is identified and no CISA KEV listing is present at time of analysis.

Technical ContextAI

Mattermost is an open-source team collaboration platform that includes a Boards feature (formerly Focalboard) with its own role model. Internally, Mattermost tracks elevated permissions via SchemeAdmin flags, which are expected to mirror a user's current system role. CWE-863 (Incorrect Authorization) describes exactly this class of flaw: the authorization enforcement layer checks the stored flag rather than the authoritative current role, creating a window where stale privilege grants remain effective. When an administrator demotes a user to the System Guest role - the most restricted role in Mattermost - the Boards subsystem's SchemeAdmin flag is not cleared, leaving that user with a cached Board Admin credential that the REST API and UI continue to honor. Affected CPE strings span three maintained release trains: 11.8.x through 11.8.3, 11.7.x through 11.7.6, and the long-term support branch 10.11.x through 10.11.21.

RemediationAI

Upgrade to a patched Mattermost release per the vendor security advisory at https://mattermost.com/security-updates. The exact fixed versions are not specified in the available intelligence beyond confirming that versions after 11.8.3, 11.7.6, and 10.11.21 address this issue - consult the advisory directly to confirm the minimum safe version for your release train. If immediate upgrade is not feasible, administrators should audit current System Guest accounts to identify any that previously held Board Admin status, then manually revoke SchemeAdmin flags for those accounts through the admin console. Additionally, restricting access to the Boards REST API endpoints at the network or reverse-proxy layer for System Guest users provides a compensating control, though this may impair legitimate Boards read access for guests and should be evaluated against operational requirements.