Mattermost Boards CVE-2026-9816

Exploitation requires an active Mattermost account with at minimum a board editor role or non-guest team member status on the target instance - unauthenticated external attackers cannot exploit this directly. The attacker must have network access to the Mattermost API (CVSS AV:N confirms the endpoint is network-reachable). Exploitation is possible through two distinct API paths: POST /api/v2/boards/{boardID}/members for direct member manipulation, and POST /api/v2/teams/{teamID}/archive/import for the archive-import path; the attacker's account must have sufficient access to invoke these endpoints against the target board or team. What limits exploitation: the mandatory authenticated account (CVSS PR:L) confines the attack surface to current users of the platform; external, unauthenticated adversaries are excluded. This makes it primarily an insider threat or a post-compromise escalation vector following credential theft.

The CVSS 8.3 High score is well-calibrated for this flaw: the attack is network-accessible (AV:N), requires no special conditions (AC:L), requires only a low-privileged account (PR:L), and carries high integrity and availability impact commensurate with unauthorized board admin escalation. The high I and A scores reflect that a board admin can restructure boards, reassign or delete tasks, and disrupt project management workflows materially. EPSS data is absent from the provided intelligence, which limits probabilistic exploitation forecasting - this gap should be resolved by checking NVD or Tenable at patch time. The vulnerability is not in the CISA KEV catalog and no POC has been publicly identified, suggesting it has not yet been broadly weaponized. That said, the barrier to exploitation is meaningfully low: any user with a valid account on a vulnerable Mattermost instance who holds board editor or non-guest team member status can exploit this, making it a realistic insider threat or post-initial-access escalation vector in any organization with a large or loosely managed Mattermost user base. Security teams should treat this as a priority patch rather than a compensating-control candidate, given the straightforward remediation path.

An authenticated Mattermost user holding a board editor role crafts a malicious POST request to /api/v2/boards/{boardID}/members, including a BoardMember.Scheme* field set to grant board admin status to a chosen target account. Because the server applies no validation to the Scheme* fields, the manipulated payload is accepted and persisted, elevating the target user to board admin without any administrator approval. From that elevated position, the attacker or colluding account can restructure boards, modify or delete tasks, and disrupt project management operations across the affected team. No public POC has been identified at time of analysis.