Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T15:16:53.087Z",
  "pubdate": "2026-08-17T15:16:53.087Z",
  "executiveSummary": "A privilege reconciliation flaw exists in Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3, specifically within the handling of user roles and SchemeAdmin flags. The vulnerability allows a user who has been demoted to a System Guest to improperly retain elevated Board Admin privileges. This authorization bypass enables unauthorized users to execute administrative operations via the Boards REST API or the user interface, violating the principle of least privilege.\nThe risk implication is significant as it breaks role-based access control (RBAC) boundaries, allowing restricted users to interact with sensitive administrative functionality within the Boards component. Exploitation requires an authenticated user whose role has been downgraded by an administrator, but no specialized exploit tooling is needed beyond standard API requests or UI interactions to leverage the stale administrative state.",
  "technicalDetails": "The root cause of the vulnerability lies in the failure of the application logic to correctly synchronize and reconcile SchemeAdmin privilege flags with a user's updated and current security role during permission evaluation checks. Specifically, when an administrator demotes a user's global or team-level role down to a restricted status such as a System Guest, the underlying authorization subsystem fails to invalidate or strip the previously assigned administrative flags associated with the Mattermost Boards feature.\nThe vulnerable components involve the authorization enforcement routines and permission verification handlers within the Boards REST API endpoints and UI controllers. Because the application relies on stale cached states or fails to validate the current user role against the active SchemeAdmin assignments, the authorization check evaluates to true for users who should otherwise be restricted.\nThe attack flow proceeds as follows: First, an attacker with a standard user or administrative role is provisioned with Board Admin privileges. Second, an administrative entity subsequently demotes the user's account to a System Guest role, expecting all administrative privileges to be revoked. Third, instead of having permissions successfully revoked, the user retains their cached or unchecked SchemeAdmin flags. Fourth, the attacker interacts with the Boards REST API or the application UI to perform administrative actions. Fifth, the backend services process the request, and due to the flawed reconciliation logic, improperly accept the stale SchemeAdmin flag, granting access to restricted operations.\nAuthentication is required as the attacker must possess a valid, albeit demoted, user session. Privilege requirements are inverted from the expected security posture, allowing a low-privileged System Guest to execute administrative-level functions. The vulnerability is accessible via the network interface exposed by the Mattermost application handling REST API calls and UI rendering."
}