What is the CVSS score of CVE-2026-6739?

CVE-2026-6739 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-6739?

Mattermost versions 10.11.0-10.11.16, 11.5.0-11.5.4, and 11.6.0-11.6.1 contain a privilege escalation vulnerability allowing authenticated users with delegated user-management permissions to modify…. A patch is available.

How to fix or mitigate CVE-2026-6739?

Within 24 hours: Inventory all Mattermost users granted delegated user-management permissions and validate business justification for each assignment. Within 7 days: Disable delegated user-management permissions except where operationally critical; implement audit logging and alerting on role API patch operations; document all role modifications made via affected versions. Within 30 days: Subscribe to Mattermost security advisories to monitor for patch release; prepare a upgrade plan to move to patched versions (10.11.17+, 11.5.5+, 11.6.2+) and execute upgrade within 48 hours of patch availability.

Mattermost CVE-2026-6739

EUVD-2026-36499 HIGH

Incorrect Authorization (CWE-863)

2026-06-12 Mattermost

GHSA-m2w9-h2mm-79qr

Authentication Bypass Mattermost

7.2

CVSS 3.1 · NVD

Severity by source

Vendor (Mattermost) PRIMARY

MEDIUM

qualitative

NVD

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable REST API (AV:N), no special conditions (AC:L), requires an existing delegated user-management admin account (PR:H), no victim interaction (UI:N), and full system_admin-equivalent compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 15:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

Jun 18, 2026 - 15:22 NVD

6.7 (MEDIUM) 7.2 (HIGH)

Analysis Generated

Jun 12, 2026 - 17:34 vuln.today

DescriptionNVD

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.. Mattermost Advisory ID: MMSA-2026-00656

AnalysisAI

Privilege escalation in Mattermost collaboration platform allows authenticated users holding delegated user-management permissions to modify built-in system role permissions via the role patch API, bypassing a required system-level permission check. Affects Mattermost 10.11.x through 10.11.16, 11.5.x through 11.5.4, and 11.6.x through 11.6.1. No public exploit identified at time of analysis; EPSS is very low (0.03%) and the SSVC framework reports no observed exploitation.

Technical ContextAI

Mattermost is a self-hostable team collaboration and messaging platform whose authorization model relies on a role-based access control (RBAC) system that distinguishes between user-scoped permissions (e.g., manage team members) and protected system-level permissions that govern built-in roles such as system_admin, team_admin, and channel_admin. The flaw is a CWE-863 incorrect authorization weakness: the role patch API endpoint enforces only the delegated user-management permission and fails to additionally require the system-level permission needed to mutate protected default roles, so a sub-admin with user-management delegation can rewrite the permission set of any built-in role. Once a built-in role definition is altered, every account that holds that role inherits the modified privileges, effectively turning a horizontal authorization gap into a server-wide privilege escalation.

RemediationAI

Patch available per vendor advisory MMSA-2026-00656 (https://mattermost.com/security-updates); upgrade to the fixed release on your branch as published by Mattermost - exact fixed build numbers are not enumerated in the provided intelligence, so consult the advisory before deployment. Until you can patch, audit and minimize the set of accounts holding delegated user-management permissions, since only those accounts can reach the vulnerable role patch API path, and consider temporarily revoking custom roles that grant user-management without full system_admin to shrink the attack surface (trade-off: sub-admins will lose self-service user management until restored). Additionally, monitor server audit logs for unexpected calls to the role patch API and for permission changes on built-in roles (system_admin, team_admin, channel_admin) as a detective control; the side effect is increased log volume and the need for a triage process for legitimate role edits.