CVE-2026-93846
Awaiting Analysis Awaiting Analysis - Queue

Mattermost Role Permission Escalation via API

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-93846
EUVD
EUVD-2026-109968

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Mattermost Mattermost 11.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.0 and 11.7.10 have a flaw where the API does not properly restrict which built-in roles can be assigned to team members. This allows a team admin to grant elevated permissions that exceed what the configured permission scheme permits through the update-team-member-roles REST API.

Impact Analysis

A team admin could exploit this to assign unauthorized roles to users, potentially granting them access to sensitive data or actions beyond their intended permissions. This could lead to unauthorized modifications or data exposure within the Mattermost workspace.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR or HIPAA. Organizations may face legal penalties or reputational damage if such breaches occur due to improper role assignments.

Mitigation Strategies

Update Mattermost to a version later than 11.7.10 to address the role assignment vulnerability. Review team member roles and permission schemes to ensure compliance with configured restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart