What is the CVSS score of EUVD-2026-38276?

EUVD-2026-38276 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-38276

Q: Which versions of Mattermost are affected by EUVD-2026-38276?

Incorrect authorization in Mattermost's demote-user API allows a lower-privileged administrator to degrade arbitrary bot accounts to guest status, affecting versions 11.7.0 and 10.11.17 and earlier.

| CVE-2026-8823 LOW

Incorrect Authorization (CWE-863)

2026-06-22 Mattermost

GHSA-xmfh-3ccg-c9fx

Mattermost Authentication Bypass

3.8

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

3.8 LOW

Admin credentials required (PR:H); impact is limited to bot account integrity and availability disruption, with no confidentiality exposure.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 16:00 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Mattermost Advisory ID: MMSA-2026-00669

AnalysisAI

Incorrect authorization in Mattermost's demote-user API allows a lower-privileged administrator to degrade arbitrary bot accounts to guest status, affecting versions 11.7.0 and 10.11.17 and earlier. The root cause is missing validation of whether the target of a demotion operation is a bot account, meaning an admin who lacks full system privileges can still weaponize the standard API endpoint against bot identities. No public exploit exists and the vulnerability is not listed in CISA KEV; its real-world priority is low given the high-privilege requirement and limited blast radius.

Technical ContextAI

Mattermost is a self-hosted team messaging platform with a role-based access control system that includes system administrators, team administrators, and lower-privilege roles including guests. Bot accounts in Mattermost are special user objects used by integrations and automated workflows; demoting a bot to a guest role strips its operational permissions and can disrupt dependent automations. The affected component is the demote-user API endpoint, which is catalogued under CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*. The root cause is CWE-863 (Incorrect Authorization): the authorization logic executes a check - confirming the caller is an administrator - but fails to perform a second, necessary check confirming the target is a valid, demotable human user rather than a protected bot account. This is a logic gap in the authorization chain, not a bypass of authentication itself.

RemediationAI

The primary remediation is to upgrade Mattermost to a version that addresses MMSA-2026-00669; consult the vendor advisory at https://mattermost.com/security-updates for confirmed fixed releases in both the 11.7.x and 10.11.x branches - exact patched version numbers are not independently confirmed from available data beyond the advisory reference. As a compensating control where immediate patching is not feasible, administrators can audit and restrict which roles have access to the demote-user API endpoint, and review current bot account configurations to ensure no unauthorized demotions have already occurred. Additionally, monitoring API call logs for unexpected invocations of the demote-user endpoint against bot account IDs can serve as a detection mechanism. The trade-off of API access restriction is potential disruption to legitimate administrative workflows that rely on the demote-user operation.