Improper Permission Validation in Mattermost Team Member Roles API
CVE-2026-26230

3.8LOW

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 March 2026

What is CVE-2026-26230?

The affected versions of Mattermost suffer from a flaw in the team member roles API endpoint, where permission validation is inadequately handled. This vulnerability allows team administrators to unilaterally demote team members to guest roles without appropriate checks, potentially undermining the security and integrity of team management within Mattermost. For guidance and remediation, refer to Mattermost Advisory ID: MMSA-2025-00531.

Affected Version(s)

Mattermost 10.11.0 <= 10.11.10

Mattermost 11.4.0

Mattermost 10.11.11

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hackit_bharat
.