Mattermost EUVD-2026-36503

The attacker must hold a valid Mattermost user session with group-link management permissions (manage_team_groups or manage_channel_groups) on at least one target team or channel, and the deployment must have group syncables in use - typically meaning LDAP/AD or SAML group sync is enabled and groups have been linked to teams or channels. Exploitation is network-reachable to the Mattermost API but is limited by the requirement for these specific delegated permissions, which excludes anonymous internet attackers and ordinary unprivileged users; user interaction is not required and the request is a single crafted API call against the affected group syncable link or patch endpoint.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures a remotely reachable, low-complexity authenticated escalation with full confidentiality, integrity, and availability impact on the workspace. EPSS and CISA KEV data were not provided in the input, and no public exploit identified at time of analysis, so probability of opportunistic mass exploitation is currently unmeasured; however, the prerequisite (a user already granted group-link permissions) is non-trivially common in enterprise deployments that use LDAP/AD group sync, making targeted insider or compromised-account exploitation realistic. The signals are internally consistent - there is no conflict between the description and the vector - but the absence of EPSS, KEV, and SSVC data means real-world exploitation prevalence cannot be confirmed and defenders should treat this as a credible insider-threat and account-compromise amplifier rather than an unauthenticated internet-facing emergency.

An attacker who has obtained or been granted a Mattermost account with group-link permissions (for example a delegated group manager or a phished mid-level user) sends a crafted PUT or POST request to a group syncable link or patch endpoint with scheme_admin set to true, naming themselves or an attacker-controlled group. The server skips the role-management authorization check and writes the elevated role, after which the attacker (and every member of the linked group) becomes team or channel admin and can read private channels, exfiltrate files, alter integrations, and pivot via webhook or slash-command tokens. No public exploit identified at time of analysis, but the API surface is well documented and a working request can be constructed directly from the official API reference.