PT-2026-76876 · Mattermost · Mattermost

Kamil-Sawicki

·

CVE-2026-9816

·

Published

2026-08-17

·

Updated

2026-08-18

CVSS v3.1

8.3

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3
Description Insufficient server-side validation of BoardMember.Scheme* fields during insert and archive-import processes allows a board editor or a non-guest team member to escalate privileges. An attacker can grant board administrator permissions to arbitrary users by interacting with the following API endpoints:
  • 'POST /api/v2/boards/{boardID}/members'
  • 'POST /api/v2/teams/{teamID}/archive/import'
Recommendations Update Mattermost versions 11.7.0 through 11.7.6 to a version newer than 11.7.6. Update Mattermost versions 10.11.0 through 10.11.21 to a version newer than 10.11.21. Update Mattermost versions 11.8.0 through 11.8.3 to a version newer than 11.8.3.

Exploit

Fix

LPE

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-9816

Affected Products

Mattermost