API Misconfiguration in Mattermost Affects Role Assignments

CVE-2026-93846

What is CVE-2026-93846?

Mattermost versions 11.7.x up to 11.7.10 contain an improper access control vulnerability that allows a team admin to assign roles to team members beyond the established permission scheme. This issue arises from inadequate restrictions on which built-in roles can be assigned via the {{update-team-member-roles}} REST API. Admins could inadvertently or intentionally elevate permissions, potentially leading to unauthorized access and escalation of privileges. It is critical for users of the affected versions to implement appropriate controls and refer to the vendor's security advisory for remediation steps.

References