Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.. Mattermost Advisory ID: MMSA-2026-00724

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T14:17:13.010Z",
  "pubdate": "2026-09-14T14:17:13.010Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in Mattermost, identified under Advisory ID MMSA-2026-00724. This vulnerability affects Mattermost versions 11.9.x (up to and including 11.9.0), 11.8.x (up to and including 11.8.4), and 11.7.x (up to and including 11.7.7). The flaw lies in the application's failure to properly enforce authorization boundaries on the endpoint responsible for updating access control policies.\nSpecifically, the vulnerability allows an attacker with channel or team administrator privileges to detach a system-assigned Attribute-Based Access Control (ABAC) parent policy. By leveraging this vulnerability, an attacker can manipulate policy inheritance, potentially granting themselves or others unauthorized permissions beyond their designated administrative boundaries.\nExploitation of this flaw requires the attacker to have at least channel or team administrator privileges, meaning it is not an unauthenticated remote code execution vulnerability. However, within multi-tenant or strictly segmented enterprise environments, the ability of low-level administrators to detach parent policies poses a severe risk to the integrity of the overall security architecture, potentially leading to unauthorized privilege escalation.",
  "technicalDetails": "The root cause of this vulnerability lies in a critical authorization boundary enforcement failure within the API handler that processes policy updates. In Mattermost, Attribute-Based Access Control (ABAC) enables administrators to define granular access control policies that determine user permissions across various resources. To maintain centralized administrative authority and strict compliance structures, the system supports hierarchical policies where parent policies (assigned by system administrators) dictate baseline restrictions that downstream roles must inherit. These inherited boundaries are represented within the policy structure via imports.\nThe vulnerability is exposed through the endpoint handler associated with the HTTP PUT request to '/api/v4/access_control_policies'. When an access control policy update request is processed, the backend system fails to adequately verify whether the user submitting the request possesses sufficient privileges to alter or remove inherited parent policies. Specifically, the authorization checks do not prevent a channel or team administrator—who is meant to have localized authority—from submitting modifications that affect global or higher-tier policy links.\nTo exploit this security flaw, an authenticated attacker with channel or team administrator privileges generates a specially crafted PUT request directed at the '/api/v4/access_control_policies' endpoint. In the body of this request, the attacker specifies the target policy identifier but modifies the structure of the policy import definition. Specifically, the attacker sets the 'imports' parameter to an empty list (e.g., '[]').\nWhen the Mattermost server receives this payload, the backend validates the request format but fails to execute the necessary boundary check to determine if removing the parent imports violates hierarchical authorization rules. The server updates the policy as requested, saving the modified configuration with the empty imports list.\nAs a direct consequence of this successful request, the system-assigned ABAC parent policy is detached from the target policy framework. This breaks the logical chain of inheritance that enforces security constraints defined by system-level administrators. Without the parent policy constraints in place, the affected local administrative roles are freed from system-assigned boundaries. This allows the attacker to bypass access controls, potentially granting elevated permissions, accessing unauthorized features, or modifying administrative settings that should otherwise be locked down by the organization's global security policies."
}