Mattermost EUVD-2026-102806

Requires an authenticated guest account on the target Mattermost server (versions 11.7.x ≤ 11.7.9, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, 11.10.x ≤ 11.10.0), plus the ability to reach the member-roles update API and issue a PUT request supplying a crafted combination of guest and admin scheme roles that the server does not validate. Limiting factors: exploitation is impossible without a valid guest login, so servers that do not provision guest accounts or that disable guest access are not exposed; no special non-default feature toggle is named beyond guest accounts being enabled. No user interaction is required and the attack is network-reachable against the vulnerable API.

This is a moderate-priority authorization flaw (CWE-863), not a top-tier emergency. The vendor-supplied CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, 6.5) rates it Medium, driven by high confidentiality and integrity impact from the privilege escalation but offset by a prerequisite of existing authentication. One signal conflicts internally: the vector states PR:H (high privileges required), yet the description says the attacker only needs an authenticated GUEST account - the lowest-privilege authenticated role - to escalate to team/channel admin. A guest is best modeled as PR:L, which would actually raise the real-world severity above the vendor's 6.5; this discrepancy should be verified with Mattermost. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input. Exploitation status: no public exploit identified at time of analysis, and there is no indication of active exploitation. Net assessment: a real but contained risk - any environment that provisions guest accounts (common for external collaboration) should patch promptly, because the barrier is merely holding a guest login, not administrative access, but there is no evidence of mass or active exploitation to warrant emergency treatment.

An attacker who has been granted (or has obtained) a low-privilege guest account on a Mattermost server sends a crafted PUT request to the member roles API endpoint, supplying a role combination mixing guest and admin scheme roles that the server fails to validate. The server accepts the malformed role assignment and promotes the guest to team or channel admin, giving the attacker administrative control over channels and their contents. No public exploit code was identified at time of analysis, and user interaction is not required.