Skip to main content

Mattermost Boards EUVDEUVD-2026-60540

| CVE-2026-9816 HIGH
Incorrect Authorization (CWE-863)
2026-08-17 responsibledisclosure@mattermost.com GHSA-h2c9-x337-f543
Mattermost Authentication Bypass Mattermost Server
8.3
CVSS 3.1 · Vendor: mattermost
Share

Severity by source

Vendor (mattermost) PRIMARY
8.3 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
vuln.today AI
8.3 HIGH

PR:L reflects mandatory authenticated low-privileged access; C:L applies because board admin escalation may expose board content but not system credentials or broader data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mattermost).

CVSS VectorVendor: mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 22:31 vuln.today
CVE Published
Aug 17, 2026 - 22:17 cve.org
HIGH 8.3

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685

AnalysisAI

Incorrect authorization in Mattermost's Boards component across versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 enables privilege escalation within board management. Board editors and non-guest team members can supply arbitrary values in BoardMember.Scheme* fields through the boards member API or archive-import endpoint, effectively granting board admin rights to any user without server-side enforcement. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privileged Mattermost account
Delivery
Target a board or team accessible to that account
Exploit
Craft POST request with manipulated BoardMember.Scheme* field
Execution
Server persists elevated role without validation
Persist
Arbitrary user gains board admin privileges
Impact
Manipulate or disrupt board data and team workflows
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an active Mattermost account with at minimum a board editor role or non-guest team member status on the target instance - unauthenticated external attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.3 High score is well-calibrated for this flaw: the attack is network-accessible (AV:N), requires no special conditions (AC:L), requires only a low-privileged account (PR:L), and carries high integrity and availability impact commensurate with unauthorized board admin escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Mattermost user holding a board editor role crafts a malicious POST request to /api/v2/boards/{boardID}/members, including a BoardMember.Scheme* field set to grant board admin status to a chosen target account. Because the server applies no validation to the Scheme* fields, the manipulated payload is accepted and persisted, elevating the target user to board admin without any administrator approval. …
Remediation Upgrade Mattermost to a version beyond the confirmed affected ranges - specifically beyond 11.7.6 on the 11.7.x branch, beyond 10.11.21 on the 10.11.x branch, and beyond 11.8.3 on the 11.8.x branch - per advisory MMSA-2026-00685 at https://mattermost.com/security-updates. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all Mattermost instances running vulnerable versions (10.11.x through 10.11.21, 11.7.x through 11.7.6, 11.8.x through 11.8.3), restrict board administrator role assignment exclusively to server-level administrators, and audit board membership changes over the past 30 days for unauthorized privilege escalations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mattermost

View all
CVE-2026-48801 HIGH POC
8.7 Jun 26

Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
CVE-2022-4044 MEDIUM POC
6.5 Nov 23

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
CVE-2022-3257 MEDIUM POC
6.5 Sep 23

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
CVE-2026-4858 CRITICAL
9.9 May 21

Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
CVE-2023-6458 CRITICAL
9.8 Dec 06

Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2024-39777 CRITICAL
9.6 Aug 01

Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
CVE-2020-26290 CRITICAL
9.6 Dec 28

Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
CVE-2026-9354 MEDIUM POC
5.5 May 24

Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
CVE-2022-1002 MEDIUM POC
5.4 Mar 18

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
CVE-2023-2193 CRITICAL
9.1 Apr 20

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
CVE-2026-7387 HIGH
8.8 Jun 12

Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-60540 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy