Live › vulnerability › CVE-2026-18551
Go to dashboardMattermost fails to validate combined guest and admin scheme roles, so an authenticated guest user can send a crafted PUT request to the member roles API. That lets the guest escalate to team or channel admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers in the listed version ranges that use guest accounts are exposed, since the attacker must already hold a guest login. Servers without guest accounts, or running a version outside the affected ranges, can skip this.
No product ranges from the sources yet.
mattermost version or the System Console, and compare against the affected ranges: 11.7.x up to 11.7.9, 11.8.x up to 11.8.5, 11.9.x up to 11.9.1, and 11.10.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
This page as .md · .json · in your agent: get_signal("CVE-2026-18551")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.