Mattermost CVE-2026-15754

Exploitation requires the attacker to hold an authenticated team administrator account within Mattermost (PR:H per CVSS vector). A prerequisite system state must exist: a channel must have been moved from the attacker's team to a different team, leaving a validation gap in the unassign endpoint. The ABAC feature must be in use and policy assignments must be configured on the target channel for the impact to be meaningful. User interaction (UI:R per CVSS) is required, reflecting that the channel-move event - typically initiated by a system administrator - must occur to open the exploitation window. Exploitation is limited to policy-assignment integrity only; there is no path to data exfiltration or service disruption. Default Mattermost deployments that do not use ABAC policy assignments are not meaningfully impacted even if technically vulnerable.

The CVSS 3.1 score of 4.2 (Medium) accurately reflects the constrained exploitation profile: Attack Complexity is High (AC:H) because successful abuse requires a channel to have already been moved to a different team, creating a narrow and often transient window; Privileges Required is High (PR:H) because the attacker must hold team administrator credentials; and User Interaction is Required (UI:R), adding a further dependency on organizational workflow events. No EPSS score was supplied in the source intelligence. There is no CISA KEV listing and no publicly available proof-of-concept or exploit code identified at time of analysis, meaning confirmed in-the-wild exploitation has not been observed. The impact is limited to integrity - specifically the unauthorized stripping of ABAC policy assignments - with no confidentiality or availability dimension. Even a mid-sized municipal IT team in olsztyn running Mattermost with ABAC policies enabled should treat this as a standard patch-cycle item rather than an emergency response, given the compounding preconditions. The primary real-world risk concentrates in environments where channels are frequently reorganized across teams and where insider threat from rogue team admins is a concern; for most deployments the attack surface is narrow.

A Mattermost team administrator with malicious intent identifies a channel that was recently migrated from their team to another team. Before the server state is fully reconciled, the attacker submits an authenticated policy-unassign API request referencing the moved channel's ID, which the endpoint processes without re-checking current team membership. The result is that ABAC policy assignments protecting the target channel in the new team are silently removed. No public proof-of-concept code has been identified, but the attack logic is straightforward for anyone with knowledge of the Mattermost API.