Mattermost EUVD-2026-36499

Attacker must already hold a Mattermost account with delegated user-management permissions (a custom or sub-admin role granted manage-users capabilities) and network reachability to the Mattermost server's REST API; full system_admin is NOT required, which is precisely why this is an escalation primitive. Exploitation is limited to deployments that actually issue such delegated roles to non-system_admin users - vanilla installations where only system_admin manages users are not exposed via this path - and requires invoking the role patch API against a protected built-in role (system_admin, team_admin, channel_admin, or similar default). No user interaction is required from victims, and no special platform or non-default server configuration beyond enabling delegated user-management is needed.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects an authenticated, network-reachable attack with high (admin-delegated) privileges already required but yielding total compromise of confidentiality, integrity, and availability - consistent with the SSVC technical impact of 'total'. SSVC also reports exploitation 'none' and automatable 'no', and EPSS is essentially floor-level at 0.03% (9th percentile), indicating no observed in-the-wild use and low mass-exploitation likelihood. This is a real but bounded priority: the precondition of an existing delegated user-management role narrows the attacker pool to insiders or already-compromised sub-admin accounts, but in any deployment that uses delegated administration (common in larger Mattermost tenants) this is a direct path from sub-admin to full system_admin and should be patched promptly. No conflicting signals in the data; the CVSS PR:H and the description's 'authenticated users with delegated user-management permissions' agree.

An attacker compromises or already controls a Mattermost account that has been delegated user-management permissions (for example, an HR or helpdesk sub-admin). They issue a crafted PATCH request to the role API targeting a built-in role such as channel_admin or team_admin and add high-impact system permissions to it; because every user holding that role automatically inherits the new permissions, the attacker - or any colluding account - gains effective system_admin capabilities over the entire Mattermost instance. No public exploit identified at time of analysis, but the attack is straightforward against the documented API once the precondition role is held.