Vulnerability · Published Aug 17, 2026 · Assigned by Mattermost

CVE-2026-9816Insufficient server-side validation of board member role fields permits privilege escalation

High 8.3

In plain English

A high-severity incorrect authorization in Mattermost from Mattermost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 71.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685

Affected products (as reported)

Vendor	Product	Versions
Mattermost	Mattermost	11.7.0 – through 11.7.610.11.0 – through 10.11.2111.8.0 – through 11.8.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References

MMSA-2026-00685 vendor-advisory