CVE-2026-15754

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 11.8.0 through 11.8.3

Description The access control policy unassign endpoint fails to re-validate if a target channel still belongs to the requesting administrator's team. This allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team. ABAC is a method of granting access based on attributes of the user, the resource, and the environment.

Recommendations Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 11.8.0 through 11.8.3 to a version newer than 11.8.3.