All vulnerabilities
CVE-2026-93846

Mattermost: Team admin can escalate a team member's permissions via the team member roles endpoint

Mattermost MattermostApplications & CMS
Open in ThreatlineRecord JSON
CVSS
3.8Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734

Text from CVE List

Affected versions 3

  • Mattermostaffected: 11.7.0 through 11.7.10CVE List
  • Mattermostunaffected: 11.11.0CVE List
  • Mattermostunaffected: 11.7.11CVE List

References 1