Vulnerability · Published Aug 17, 2026 · Assigned by Mattermost

CVE-2026-15754Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Medium 4.2

In plain English

A medium-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 84.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.7.0 – through 11.7.611.8.0 – through 11.8.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N

References

MMSA-2026-00718 vendor-advisory