CVE-2026-82920

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7

Description Authorization boundaries are not properly enforced on the access control policy update endpoint. This allows a channel or team administrator to detach a system-assigned ABAC (Attribute-Based Access Control) parent policy by sending a crafted PUT request to the '/api/v4/access control policies' endpoint with an empty imports list.

Recommendations Update Mattermost version 11.9.0 to a newer version. Update Mattermost version 11.8.4 to a newer version. Update Mattermost version 11.7.7 to a newer version. Restrict access to the '/api/v4/access control policies' endpoint to minimize the risk of exploitation.