Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T15:16:53.857Z",
  "pubdate": "2026-08-17T15:16:53.857Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Mattermost versions 11.7.x <= 11.7.6 and 10.11.x <= 10.11.21 related to the handling of board archive imports. The vulnerability arises from a failure in access control logic during the import process, which improperly permits guest users to receive Board Admin privileges. An attacker possessing board member privileges can leverage this flaw to elevate a guest user to a Board Admin role by importing a maliciously crafted .boardarchive file. This impacts the authorization boundary between restricted guest accounts and administrative roles within the board component of Mattermost systems. The risk implication involves unauthorized administrative access and potential compromise of sensitive board data and configurations. Successful exploitation requires an attacker to already possess board member access to initiate the board archive import procedure using the crafted payload.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient role-based access control checks within the board archive import functionality of Mattermost. When importing a .boardarchive file, the application parses the archive contents and reconstructs the board state and user permissions. Affected versions 11.7.x <= 11.7.6 and 10.11.x <= 10.11.21 fail to correctly enforce restrictions preventing guest users from being assigned elevated roles during this state restoration. Consequently, the import handler blindly processes the privilege definitions embedded within the archive file without validating whether the target user account possesses the appropriate baseline permissions to hold a Board Admin role.\nTo execute the attack, an actor authenticated with board member privileges crafts a malicious .boardarchive file containing manipulated permission mappings or role assignments that target a specific guest user account. The attacker then uploads and imports this crafted archive into the Mattermost instance via the standard board import interface. Upon processing the archive, the vulnerable component applies the role assignments defined within the payload, bypassing expected security boundaries and successfully elevating the targeted guest user to Board Admin status.\nThe attack requires authentication as a board member to initiate the import process and involves network access to the Mattermost server. The post-exploitation impact includes unauthorized administrative control over specific boards, enabling the newly elevated user to modify board settings, manage member access, and view restricted data beyond the intended constraints of a guest user profile."
}