CVE-2026-16048
Received Received - Intake

Privilege Escalation in Mattermost via Channel Member Roles

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-16048
EUVD
EUVD-2026-60206

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.8.2 (inc)
mattermost mattermost to 11.7.6 (inc)
mattermost mattermost to 10.11.21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.8.0 and 11.8.2, 11.7.0 and 11.7.6, and 10.11.0 and 10.11.21 have a flaw where channel administrators can assign channel-scoped roles to themselves or others, granting elevated permissions beyond intended limits. This occurs via the channel member roles API.

Detection Guidance

This vulnerability can be detected by checking Mattermost server versions against the affected releases (11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21). Use commands like 'curl -s http://your-mattermost-server/api/v4/config/client | grep Version' to check the version. If the version is within the affected range, the system is vulnerable.

Impact Analysis

An attacker with channel administrator privileges could escalate their permissions within a channel, potentially accessing sensitive information or performing unauthorized actions. This could lead to data breaches or unauthorized modifications in restricted channels.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and segregation of duties, such as GDPR's data protection principles or HIPAA's access control rules. Unauthorized privilege escalation may result in non-compliance and potential legal penalties.

Mitigation Strategies

Update Mattermost to a version that is not affected by this vulnerability. Specifically, upgrade to versions 11.8.3 or later, 11.7.7 or later, or 10.11.22 or later to address the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart