Skip to content
Sign in
3.8 Low

CVE-2026-93846 Mattermost versions…

Description

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734

Affected products and versions

Product Affected versions Fixed in
Mattermost 11.11 earliest → < 11.11.0 11.11.0
Mattermost 11.7 11.7.0 → 11.7.10 11.7.11

Other CVEs of Mattermost

The 480 CVEs of Mattermost →
CVE-2026-93851 Mattermost versions… 8.0 High CVE-2026-93848 Mattermost versions… 2.7 Low CVE-2026-93850 Mattermost versions… 6.5 Medium CVE-2026-93849 Mattermost versions… 6.5 Medium
Track this CVE