Server-side Validation Flaw in Mattermost Product Allows Unauthorized Permissions
CVE-2026-9816

8.3HIGH

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
17 August 2026

What is CVE-2026-9816?

Mattermost versions 11.7.x up to and including 11.7.6, 10.11.x up to and including 10.11.21, and 11.8.x up to and including 11.8.3 contain a vulnerability that fails to properly validate the BoardMember.Scheme fields during server-side processing. This weakness can be exploited by board editors or non-guest team members, enabling them to grant board admin privileges to unauthorized users through specific API endpoints. Affected users are advised to consult the Mattermost Advisory ID MMSA-2026-00685 for further information on how to mitigate this vulnerability.

Affected Version(s)

Mattermost 11.7.0 <= 11.7.6

Mattermost 10.11.0 <= 10.11.21

Mattermost 11.8.0 <= 11.8.3

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kamil-sawicki
.