CVE-2026-8074

Name of the Vulnerable Software and Affected Versions Mattermost version 11.7.0 Mattermost versions prior to 10.11.17

Description Insufficient enforcement of bot-specific permission checks on the user active status endpoint allows a User Manager with user management write access, but lacking Integrations access, to deactivate bot accounts. This is possible through the 'PUT /api/v4/users/{id}/active' API endpoint using the id variable.

Recommendations Update version 11.7.0 to a newer version that contains a fix. Update versions prior to 10.11.17 to version 10.11.17 or later. As a temporary workaround, restrict access to the 'PUT /api/v4/users/{id}/active' API endpoint for users without Integrations access.