Mattermost EUVD-2026-60206

Exploitation requires an authenticated Mattermost account with the channel administrator role assigned within at least one channel - corresponding to PR:L in the CVSS vector. The attacker does not need system-level or team-level administrative access; the channel administrator role alone is sufficient. Exploitation is bounded by the unchanged scope (S:U), meaning direct system-wide privilege escalation is not achievable via this flaw in isolation. Unauthenticated users, regular channel members without the channel administrator role, and users on unaffected version branches cannot exploit this vulnerability. No non-default configuration or special feature flag is required beyond possessing the channel administrator role; the flaw is present in the default role assignment logic of all affected versions.

The CVSS 6.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects a network-accessible, low-complexity attack requiring only channel administrator authentication, with limited CIA impact confined to the channel scope - a reasonable assessment for an intra-platform privilege escalation. No EPSS score was included in the available intelligence, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No proof-of-concept code was identified at time of analysis. The real-world risk is shaped significantly by how broadly channel administrator roles are distributed within a given deployment: in a loosely governed Mattermost instance, even a mid-sized municipal IT team in sopot could find that many ordinary users hold channel admin rights and are therefore capable of exploiting this flaw without any special access. The S:U (unchanged scope) metric aligns with the description's framing of 'additional channel permissions' rather than system-wide privilege escalation, which bounds the blast radius - but sensitive channels containing confidential project data, HR discussions, or executive communications represent meaningful targets even without full system compromise.

An authenticated Mattermost user who holds the channel administrator role within a sensitive channel crafts a direct API call to the channel member roles endpoint, submitting a role payload referencing a non-channel-scoped system or team role. The server processes the assignment without validating role scope, granting the attacker elevated permissions within the channel beyond the channel administrator's intended privilege boundary. No proof-of-concept code has been publicly identified, but the attack requires only standard HTTP tooling and knowledge of the Mattermost API.