Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-17T22:17:27.217Z",
  "pubdate": "2026-08-17T22:17:27.217Z",
  "executiveSummary": "An improper authorization and input validation vulnerability has been identified in Mattermost, specifically affecting the server-side handling of BoardMember.Scheme* fields. This security flaw enables a malicious actor possessing board editor privileges or non-guest team member status to illicitly escalate arbitrary users to board administrator privileges.\nThe vulnerability affects Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3. Successful exploitation compromises the access control boundaries of Mattermost boards, allowing unauthorized privilege elevation.\nThe attack vector requires authenticated access, specifically leveraging low-privileged roles such as board editors or non-guest team members. Attackers exploit this capability by interacting with specific API endpoints to inject unauthorized schema configurations during board member insertion or archive import operations.\nThe risk implication is severe, as unauthorized users gain administrative control over sensitive boards, potentially leading to data exfiltration, unauthorized modification of project assets, and further compromise of internal team communications. Mitigation requires immediate application of official patches provided by Mattermost.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of the BoardMember.Scheme* fields within the Mattermost application logic. When processing requests via the POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import endpoints, the application fails to adequately verify whether the submitting user possesses the necessary administrative authorization to assign specific scheme roles to target accounts.\nThe vulnerable components are the server-side controllers and validation routines responsible for parsing and persisting board membership records and archive import data. The affected software versions comprise Mattermost 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3.\nThe exploitation method relies on parameter manipulation within HTTP POST requests directed at the aforementioned API endpoints. An attacker authenticated as a standard board editor or a non-guest team member crafts a malicious payload containing elevated schema identifiers within the BoardMember.Scheme* parameters. Because the server lacks proper validation to cross-reference the session privileges against the requested privilege assignment, the backend processes the request and commits the escalated permissions to the database.\nDuring the POST /api/v2/boards/{boardID}/members attack flow, the attacker supplies manipulated scheme definitions directly when adding or modifying a membership record. Alternatively, via the POST /api/v2/teams/{teamID}/archive/import path, the attacker uploads or processes a maliciously crafted archive containing pre-configured membership objects with unauthorized administrative scheme mappings.\nAuthentication and privilege requirements dictate that the attacker must already possess a valid session token corresponding to at least a board editor or a non-guest team member role. The network exposure is standard HTTP/HTTPS API accessibility inherent to Mattermost deployments. Post-exploitation impact includes full administrative control over targeted boards, allowing the attacker to manage users, alter configurations, access confidential board content, and bypass intended role-based access control (RBAC) mechanisms."
}