Mattermost EUVD-2026-38276

Exploitation requires an authenticated session with administrator-level privileges on the Mattermost instance - specifically a 'lower-privileged administrator' role that has access to the demote-user API. The attacker must know or enumerate the user ID of a target bot account. The vulnerability applies to default Mattermost deployments running the affected versions since the demote-user API is a standard platform feature; however, exploitation is limited to actors who already hold an admin credential, excluding unauthenticated or standard user-level attackers. Exploitation does NOT require any special configuration - only administrative access and knowledge of a bot account ID. The primary limiting factor is the high-privilege prerequisite (CVSS PR:H), which restricts the realistic attacker pool to malicious insiders, compromised admin accounts, or privilege-escalation chaining scenarios.

The vendor-assigned CVSS 3.1 score of 3.8 (Low) is well-calibrated and consistent with the available signals. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L confirms the attack is network-accessible with no interaction required but mandates high-privilege credentials (PR:H), which substantially limits the attacker pool to authenticated administrators. There is no confidentiality impact; the damage is constrained to low integrity and low availability effects on targeted bot accounts. No EPSS score was provided in the source data, but given the PR:H requirement and narrow impact scope, exploitation probability should be low. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. The 'Authentication Bypass' tag in the source intelligence is somewhat misleading - this is an authorization gap within an authenticated admin session, not a bypass of the authentication layer itself. Real-world priority is low: exploitation requires a malicious or compromised admin account, and impact is limited to disrupting bot integrations rather than data exfiltration or full system compromise.

An authenticated Mattermost administrator with lower-privileged access - such as a team admin or a sub-admin role - calls the standard demote-user API endpoint, supplying the user ID of a bot account as the target. Because the API does not validate that the target is a bot, the request succeeds, downgrading the bot to a guest role and breaking any integrations or automated workflows that depend on that bot's elevated permissions. No public proof-of-concept has been identified at time of analysis.