Vulnerability · Published Jun 22, 2026 · Assigned by Mattermost

CVE-2026-8074Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Low 3.8

In plain English

A low-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.3%top 75.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/mattermost/mattermost-server	11.7.1	GHSA-g5vr-6pgg-74qv
Go	github.com/mattermost/mattermost-server	10.11.18	GHSA-g5vr-6pgg-74qv
Go	github.com/mattermost/mattermost-server	10.11.18+incompatible, 11.7.1+incompatible	GO-2026-6481

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.7.0 – through 11.7.010.11.0 – through 10.11.17

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

References

MMSA-2026-00667 vendor-advisory