Live › vulnerability › CVE-2026-93846
Go to dashboardMattermost versions 11.7.x up to 11.7.10 do not restrict which built-in roles a team admin can assign to a team member through the update-team-member-roles API. A team admin can therefore give a member more permissions than the configured permission scheme allows.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the 11.7.x line up to 11.7.10 where team admins exist and a permission scheme limits built-in roles. Exposure depends on a team admin being the one who escalates, so servers with no delegated team admins face less risk. Installations already on a fixed release can skip it.
No product ranges from the sources yet.
mattermost version on the server; affected versions are 11.7.0 through 11.7.10.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734
This page as .md · .json · in your agent: get_signal("CVE-2026-93846")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.