Description

Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-17T15:16:54.310Z",
  "pubdate": "2026-08-17T15:16:54.310Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified in Mattermost, specifically affecting the channel member roles API. The vulnerability stems from a failure to properly restrict channel member role assignment to channel-scoped roles. An authenticated attacker with existing channel administrator privileges can exploit this flaw to assign unauthorized roles to themselves or others, thereby gaining elevated channel permissions beyond their intended authorization scope. This issue impacts multiple supported product version branches, posing a significant risk to organizational workspace security by undermining access control boundaries within specific communication channels. Successful exploitation requires authenticated access and malicious interaction with the vulnerable channel member roles API endpoint. Remediation necessitates applying the official vendor-supplied patches provided for the affected version ranges to enforce strict authorization checks on role assignment requests.",
  "technicalDetails": "The vulnerability resides within the role management logic of the Mattermost API, specifically handling channel member role assignments. The root cause of the security defect is insufficient server-side validation and scoping checks when processing requests via the channel member roles API. Specifically, the application fails to adequately enforce boundaries that restrict role assignments strictly to channel-scoped roles.\nThe attack flow requires an adversary to possess initial channel administrator privileges within a targeted channel. Operating with these lower-tier privileges, the attacker crafts malicious HTTP requests targeted at the channel member roles API. By manipulating the parameters governing role assignment, the attacker bypasses intended authorization boundaries. Because the API improperly validates whether the requested role exceeds the permissible scope for a channel administrator, the backend system processes the request and grants unauthorized, elevated permissions to the user.\nThe vulnerable components involve the API endpoints responsible for updating and assigning channel member roles within Mattermost. The affected software versions comprise Mattermost versions 11.8.x up to 11.8.2, 11.7.x up to 11.7.6, and 10.11.x up to 10.11.21. Exploitation requires standard user authentication and a prerequisite privilege level equivalent to a channel administrator. The network exposure is commensurate with the standard deployment of the Mattermost server instance, typically accessible over HTTP/HTTPS by authenticated users.\nThe post-exploitation impact allows a malicious channel administrator to acquire unauthorized administrative or specialized capabilities within the scope of the channel, leading to a violation of the principle of least privilege, potential data exposure, or unauthorized administrative manipulation of channel settings and communications."
}