CVE-2026-82920
Received Received - Intake

Authorization Bypass in Mattermost Access Control Policy Update

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.. Mattermost Advisory ID: MMSA-2026-00724

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-82920
EUVD
EUVD-2026-77487

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.9.0 (inc)
mattermost mattermost to 11.8.4 (inc)
mattermost mattermost to 11.7.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Mattermost versions between 11.7.7 and 11.9.0 have a flaw where channel or team administrators can bypass authorization checks. By sending a crafted request to update access control policies, they can detach a system-assigned policy by setting an empty imports list. This allows unauthorized modification of security policies.

Detection Guidance

Detecting this vulnerability requires checking Mattermost server logs for unauthorized PUT requests to /api/v4/access_control_policies with an empty imports list. Monitor for channel or team administrators making such requests.

Impact Analysis

An attacker with admin privileges could weaken security policies, potentially exposing sensitive data or disrupting system access controls. This could lead to unauthorized access, data leaks, or compliance violations depending on the system's use case.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected versions may fail compliance audits.

Mitigation Strategies

Upgrade Mattermost to a patched version (11.9.1 or later, 11.8.5 or later, 11.7.8 or later). Review access logs for suspicious PUT requests to the endpoint mentioned. Restrict administrative privileges to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82920. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart