CVE-2026-16048

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.8.0 through 11.8.2 Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21

Description A flaw exists where the system fails to restrict channel member role assignments to channel-scoped roles. This allows a channel administrator to obtain unauthorized additional channel permissions by interacting with the channel member roles API.

Recommendations Update Mattermost versions 11.8.0 through 11.8.2 to a version newer than 11.8.2. Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 10.11.0 through 10.11.21 to a version newer than 10.11.21.