What is the CVSS score of CVE-2026-7387?

CVE-2026-7387 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-7387?

Mattermost server versions 10.11.x, 11.5.x, and 11.6.x contain a privilege escalation vulnerability allowing authenticated users with group-link permissions to escalate to administrator access,…. A patch is available.

How to fix or mitigate CVE-2026-7387?

24 hours: Inventory all Mattermost deployments running 10.11.x, 11.5.x, or 11.6.x; audit current users with group-link permissions and their recent activities. 7 days: Restrict group-link permissions to essential trusted personnel only; disable group syncable link and patch API endpoints if not operationally required; enable comprehensive audit logging for all permission and role changes. 30 days: Upgrade to Mattermost 12.0.x or later once vendor security patch is released; conduct post-upgrade security assessment; review audit logs for unauthorized privilege escalation attempts.

Mattermost CVE-2026-7387

EUVD-2026-36503 HIGH

Incorrect Authorization (CWE-863)

2026-06-12 Mattermost

GHSA-6hxm-w4hv-vgvw

Authentication Bypass Mattermost

8.8

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remotely callable API (AV:N/AC:L), requires an authenticated user with delegated group-link permission (PR:L), no user interaction, and admin escalation yields full C/I/A on the workspace.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 17:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests.. Mattermost Advisory ID: MMSA-2026-00665

AnalysisAI

Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding group-link permissions to promote themselves or other group members to team or channel administrator by setting the scheme_admin flag through group syncable link and patch API endpoints. The flaw stems from missing role-management authorization checks, and with a CVSS of 8.8 (network, low complexity, low privileges) it enables tenant-wide takeover of collaboration workspaces; no public exploit identified at time of analysis.

Technical ContextAI

Mattermost is a self-hosted team collaboration platform whose authorization model assigns elevated roles via the scheme_admin boolean on team and channel membership records. Group syncable objects link an LDAP/SAML group to a team or channel and propagate membership and role assignments, so the affected /api/v4 endpoints that create or patch these links are highly privileged. The underlying CWE-863 (Incorrect Authorization) indicates the handler validates that the caller can manage group linkage but fails to additionally require the role-management permission needed before honoring scheme_admin, conflating two distinct permission scopes. The affected CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* confirms the server product itself is vulnerable rather than a desktop or mobile client.

RemediationAI

Patch available per vendor advisory MMSA-2026-00665 at https://mattermost.com/security-updates - upgrade to the fixed release on your branch (post-11.6.1 for the 11.6 line, post-11.5.4 for 11.5, and post-10.11.16 for 10.11; consult the advisory for the exact fixed build number, which is not enumerated in the input data). Until the upgrade is applied, the most effective compensating control is to audit and minimize who holds the manage_team_groups and manage_channel_groups permissions, removing them from non-admin roles, since possession of those permissions is the precondition for exploitation; expect that this will temporarily block legitimate group-link management until elevated admins perform it. As additional defense, enable audit-log review and alert on PUT/POST requests to the /api/v4/groups/{group_id}/teams/{team_id}/link and /channels/{channel_id}/link endpoints containing scheme_admin:true, and rotate sessions for any accounts that previously held group-link rights.