Mattermost CVE-2026-93846

Exploitation requires the attacker to already hold the team admin role on an affected Mattermost server (versions 11.7.x up to and including 11.7.10) and to invoke the update-team-member-roles REST API; the server fails to restrict which built-in roles that endpoint may assign to a team member. The limiting factors are substantial: PR:H means pre-existing authenticated team-admin access is mandatory, the impact is bounded to team-member role assignment within the team (scope unchanged), and only built-in roles are involved. This is realistically an insider or compromised-admin risk rather than remote unauthenticated exploitation.

This is a low-priority, high-privilege authorization flaw rather than a widespread threat. The supplied CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) yields a base score of 3.8 (Low), and the PR:H metric means the actor must already hold an elevated role - the description identifies this as a team admin. The vuln.today decision label is 'monitor', the lowest-urgency signal, which is consistent with the low score. No EPSS probability was provided in the input, there is no CISA KEV listing, and no public exploit or PoC reference is present, so all three exploitation-likelihood signals are either absent or negative; exploitation status is best stated as no public exploit identified at time of analysis. The signals do not conflict: a privilege-boundary bug exploitable only by an existing team admin, with modest confidentiality/integrity impact and no availability impact, is a genuine authorization-model defect but not an emergency. The main caveat is that EPSS data is simply missing (not low), so prioritization rests on the CVSS/SSVC 'monitor' signal and the PR:H precondition rather than a measured exploitation probability.

A user who already holds the team admin role on a Mattermost 11.7.x through 11.7.10 server calls the update-team-member-roles REST API to assign a built-in role whose permissions exceed what the configured permission scheme should allow, thereby elevating a chosen team member beyond the intended boundary. The attack is network-reachable but requires the attacker to be an authenticated team admin (PR:H), limiting it to insiders or compromised team-admin accounts. No public exploit identified at time of analysis.