Description

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-17T15:16:53.743Z",
  "pubdate": "2026-08-17T15:16:53.743Z",
  "executiveSummary": "An access control policy unassignment vulnerability exists in Mattermost versions 11.7.x <= 11.7.6 and 11.8.x <= 11.8.3.\nThe vulnerability allows an authenticated team administrator to remove attribute-based access control (ABAC) policy assignments from channels that reside outside of their administrative team boundary.\nThe root cause stems from a failure in the access control policy unassign endpoint to re-validate that target channels still belong to the requesting administrator's team, particularly after a channel has been relocated to a different team.\nThe attack vector requires the adversary to possess authenticated team administrator privileges within the application.\nSuccessful exploitation compromises the integrity of organizational access control policies by enabling unauthorized removal of ABAC constraints from sensitive channels across team boundaries.\nRisk implications include privilege boundary violations and administrative misconfigurations across multi-tenant or multi-team enterprise environments.",
  "technicalDetails": "The vulnerability resides within the access control policy unassign API endpoint of Mattermost versions 11.7.x <= 11.7.6 and 11.8.x <= 11.8.3.\nThe root cause is a broken object-level authorization and insufficient validation logic during the execution of the policy unassignment operation.\nSpecifically, the endpoint processes unassignment requests for target channels without re-verifying whether each target channel continues to belong to the requesting team administrator's authorized team scope.\nThis authorization bypass becomes exploitable in scenarios where a channel has been previously moved to another team, yet retains stale references or permits out-of-scope administrative API interactions.\nAuthentication and privilege requirements dictate that the attacker must possess valid credentials and an active session as a team administrator.\nThe attack flow proceeds as follows: First, the adversary identifies or targets a channel that was previously associated with their administrative team but has subsequently been moved to a different team. Second, the attacker crafts an API request targeting the policy unassign endpoint, specifying the target channel IDs that now reside outside their administrative jurisdiction. Third, because the vulnerable endpoint fails to enforce re-validation checks against the current team ownership of the channels, the backend processes the request. Finally, the attribute-based access control (ABAC) policy assignments are successfully stripped from the out-of-scope channels.\nPost-exploitation impact includes the unauthorized removal of security boundaries enforced by ABAC policies, potentially exposing enterprise channels to unintended access states and undermining the security posture defined by global or localized administrative controls."
}