---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mattermost contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Executive Summary:
An incorrect authorization flaw in Mattermost allows authenticated attackers to perform unauthorized actions, potentially leading to full system impact.

Vulnerability Details

CVE-ID: CVE-2026-9816

Affected Software: Mattermost

Affected Versions: 11.7.0 through 11.7.6, 10.11.0 through 10.11.21, 11.8.0 through 11.8.3

Vulnerability: This is an incorrect authorization vulnerability (CWE-863) that occurs when a low-privileged authenticated user can bypass intended access controls. The flaw permits unauthorized operations that should be restricted to administrative or higher-level roles.

Business Impact

Successful exploitation allows an authenticated user to perform actions outside their assigned permissions, which could lead to the compromise of confidential communications or unauthorized modification of system data. With a CVSS score of 8.3, the risk of privilege escalation and data integrity loss is substantial for enterprise collaboration environments.

Remediation Plan

Immediate Action: Update Mattermost to versions 11.9.0, 11.7.7, 10.11.22, or 11.8.4 or higher to resolve the authorization logic errors.

Proactive Monitoring: Monitor audit logs for suspicious administrative actions performed by standard user accounts or unexpected changes to channel and team permissions.

Compensating Controls: Implement strict role-based access control (RBAC) policies and limit the number of users with high-level privileges until the environment is patched.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly sensitive due to the potential for unauthorized administrative actions.

Analyst Recommendation

Organizations utilizing Mattermost must prioritize these updates to maintain the integrity of their collaboration platforms. Applying the vendor-provided patches is the only reliable method to remediate this authorization bypass.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16
---END_METADATA---

Description Summary:
Mattermost fails to enforce role-management authorization on group syncable link and patch endpoints, allowing for unauthorized privilege escalation.

Executive Summary:
A critical authorization flaw in Mattermost allows users to escalate their privileges to team or channel administrator status via crafted API requests.

Vulnerability Details

CVE-ID: CVE-2026-7387

Affected Software: Mattermost

Affected Versions: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16

Vulnerability: The vulnerability exists because the application does not require proper role-management authorization when setting the scheme_admin flag. A user with group-link permissions can send a crafted API request to escalate their own account—or those of group members—to team or channel admin privileges.

Business Impact

With a CVSS score of 8.8, this privilege escalation vulnerability allows an attacker to gain elevated control over team and channel communications. This could lead to unauthorized access to private channels, information disclosure, and the potential to disrupt organizational communication channels.

Remediation Plan

Immediate Action: Update to the latest patched version of Mattermost provided by the vendor.

Proactive Monitoring: Audit user account roles and permissions for unexpected administrative assignments and monitor API logs for unusual requests to group syncable endpoints.

Compensating Controls: Temporarily restrict group-link permissions for non-administrative users until the patch can be applied.

Exploitation Status

Public Exploit Available: null

Analyst Notes: As of June 13, 2026, there is no public information indicating active exploitation of this vulnerability. Nevertheless, the ability to grant oneself administrative rights is a high-risk activity that must be remediated promptly to prevent unauthorized access.

Analyst Recommendation

Privilege escalation in communication platforms can have severe consequences for organizational security. Administrators should prioritize updating their Mattermost instances and perform a comprehensive review of current administrative assignments to identify and revert any unauthorized escalations.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, 11.4.0 through 11.4.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Mattermost allows an authenticated user with high privileges to access sensitive information due to improper exposure constraints.

Executive Summary:
Mattermost versions 11 are affected by an information disclosure vulnerability that requires high-level authentication to exploit.

Vulnerability Details

CVE-ID: CVE-2026-6347

Affected Software: Mattermost Mattermost

Affected Versions: 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, 11.4.0 through 11.4.3

Vulnerability: The flaw is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It requires an attacker to possess high privileges (PR:H) to perform the unauthorized data access.

Business Impact

The vulnerability carries a CVSS score of 7.6 (High), reflecting a significant risk of data exposure. While the requirement for high-level administrative privileges limits the attack surface, the potential for unauthorized access to sensitive organizational communications could lead to severe reputational damage and the compromise of confidential internal data.

Remediation Plan

Immediate Action: Update Mattermost instances to versions 11.6.0, 11.5.2, 10.11.14, or 11.4.4.

Proactive Monitoring: Audit administrative access logs for unusual data export or query patterns that deviate from standard operational behavior.

Compensating Controls: Ensure strict adherence to the Principle of Least Privilege (PoLP) to minimize the number of accounts possessing the high-level permissions required to trigger this vulnerability.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for elevated privileges makes it less attractive for automated mass-exploitation, but internal threat actors or compromised administrative credentials pose a credible risk.

Analyst Recommendation

Given the High severity rating, organizations should prioritize patching affected Mattermost server installations. Administrators must verify their current version strings against the provided list and apply the identified security updates during the next maintenance window to prevent potential unauthorized data access.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, 11.4.0 through 11.4.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A vulnerability in Mattermost allows an authenticated user with high privileges to perform unauthorized actions leading to information disclosure and integrity compromise.

Executive Summary:
Mattermost versions 11 contain a critical information and integrity vulnerability that requires high-level administrative access to exploit.

Vulnerability Details

CVE-ID: CVE-2026-6346

Affected Software: Mattermost Mattermost

Affected Versions: 11.5.0 through 11.5.1, 10.11.0 through 10.11.13, 11.4.0 through 11.4.3

Vulnerability: This is a CWE-200 vulnerability (Exposure of Sensitive Information) that also impacts integrity. It requires an attacker to hold high privileges (PR:H) to successfully execute the exploit.

Business Impact

With a CVSS score of 8.7 (High), this vulnerability poses a severe risk to system integrity and data confidentiality. An attacker with the necessary administrative credentials could bypass security controls to access or modify sensitive platform data, potentially leading to a complete compromise of the communication environment.

Remediation Plan

Immediate Action: Update the Mattermost server to versions 11.6.0, 11.5.2, 10.11.14, or 11.4.4.

Proactive Monitoring: Review system logs for unauthorized configuration changes or access to sensitive data objects typically restricted to high-level administrators.

Compensating Controls: Implement multi-factor authentication (MFA) for all administrative accounts to reduce the likelihood of credential compromise, which is a prerequisite for this exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is high, the requirement for high-level administrative privileges necessitates a focus on securing administrative sessions and credentials.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of the Mattermost platform. IT teams should treat this as a priority update and apply the vendor-provided patches immediately to ensure that administrative access is not leveraged to compromise sensitive data.

---METADATA---
VENDOR: Mattermost
PRODUCT: Mattermost
AFFECTED_VERSIONS: 11.6.0, 11.5.0 through 11.5.3, 11.4.0 through 11.4.4, 10.11.0 through 10.11.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Mattermost is susceptible to a path traversal vulnerability that could allow an authenticated attacker with limited privileges to access restricted directory contents.

Executive Summary:
A path traversal vulnerability in Mattermost allows authenticated attackers to potentially access unauthorized files, posing a high risk to system integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-4858

Affected Software: Mattermost Mattermost

Affected Versions: 11.6.0, 11.5.0-11.5.3, 11.4.0-11.4.4, 10.11.0-10.11.14

Vulnerability: This is a path traversal vulnerability (CWE-22) residing in the server application. The vulnerability allows an authenticated user with low privileges to manipulate file paths, potentially leading to unauthorized information disclosure or system impact.

Business Impact

Successful exploitation of this flaw could result in the unauthorized disclosure of sensitive server-side files or configuration data. Given the CVSS score of 8.0, this represents a significant risk, particularly in environments where Mattermost houses proprietary communication or internal documentation.

Remediation Plan

Immediate Action: Update Mattermost instances to version 11.7.0, 11.6.1, 11.5.4, 11.4.5, or 10.11.15 to resolve the path traversal flaw.

Proactive Monitoring: Monitor server access logs for unusual directory traversal patterns or unauthorized requests targeting sensitive system files.

Compensating Controls: Implement strict file system permissions for the service account running the Mattermost application to limit the potential impact of traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which serves as a primary barrier to entry for external attackers.

Analyst Recommendation

The vulnerability is severe due to the potential for unauthorized file access. Administrators should prioritize the deployment of the provided security updates across all affected production environments immediately.

---METADATA---
VENDOR: Mattermost
PRODUCT: Plugin Legal Hold
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the Mattermost Plugin Legal Hold allows for potential security bypasses in version 1 and earlier.

Executive Summary:
The Mattermost Plugin Legal Hold is affected by a high-severity vulnerability that could facilitate unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-3524

Affected Software: Mattermost Plugin Legal Hold

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the Legal Hold plugin for Mattermost, potentially allowing an attacker to bypass intended security controls. The flaw may allow unauthorized access to sensitive legal hold data depending on the authentication context.

Business Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive legal records stored within the Mattermost environment. With a CVSS score of 8.8, this poses a substantial risk to legal compliance and organizational confidentiality.

Remediation Plan

Immediate Action: Update the Legal Hold plugin to the latest available version provided by Mattermost.

Proactive Monitoring: Review audit logs for unauthorized access to the Legal Hold plugin or export functions.

Compensating Controls: Limit access to the Legal Hold plugin functionality to a restricted set of authorized users using role-based access controls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the high CVSS score necessitates immediate attention to ensure sensitive legal data remains protected.

Analyst Recommendation

Organizations utilizing the Mattermost Legal Hold plugin must update to the latest version immediately to mitigate this high-risk vulnerability. Ensuring that security patches are applied promptly is critical for maintaining data integrity.

---METADATA---
VENDOR: Mattermost
PRODUCT: Desktop App
AFFECTED_VERSIONS: Versions 6.0 and earlier
---END_METADATA---

Description Summary:
Mattermost Desktop App versions 6 and earlier are affected by a high-severity vulnerability that could compromise the security of the communication platform.

Executive Summary:
Legacy versions of the Mattermost Desktop App contain a significant security flaw that poses a risk to organizational communications and endpoint security.

Vulnerability Details

CVE-ID: CVE-2026-1046

Affected Software: Mattermost Desktop App

Affected Versions: Versions <= 6

Vulnerability: While specific technical details of the vulnerability type are not fully disclosed in the summary, the high CVSS score indicates a severe flaw, likely involving remote code execution or significant privilege escalation within the desktop client.

Business Impact

A compromise of a communication tool like Mattermost can lead to the exposure of sensitive internal discussions, credentials, and private company data. With a CVSS score of 7.6, the vulnerability represents a high risk to the confidentiality and integrity of the organization’s internal communications.

Remediation Plan

Immediate Action: Upgrade all Mattermost Desktop App installations to a version higher than 6.0 immediately to resolve this security issue.

Proactive Monitoring: Audit the environment to identify any remaining legacy versions of the Mattermost client and monitor for suspicious authentication attempts to the Mattermost server.

Compensating Controls: Implement mandatory version checks at the server level to prevent older, vulnerable clients from connecting to the corporate Mattermost instance.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 17, 2026, there is no public information indicating active exploitation. However, communication tools are high-value targets for attackers seeking to intercept internal corporate data.

Analyst Recommendation

The high severity of this entry necessitates an immediate transition away from version 6 and earlier of the Mattermost Desktop App. Administrators should automate the deployment of the latest client version and enforce its use to mitigate the risk of exploitation.

Executive Summary:
A high-severity vulnerability has been discovered in multiple Mattermost products that could allow an authenticated user with low-level privileges to escalate their access to that of a full system administrator. Successful exploitation could lead to a complete compromise of the platform, enabling an attacker to access, modify, or delete sensitive company data and disrupt critical business communications.

Vulnerability Details

CVE-ID: CVE-2025-9072

Affected Software: Mattermost Multiple Products

Affected Versions: All versions within the 10.x branch prior to the patched releases. See vendor advisory for specific affected versions.

Vulnerability: A privilege escalation vulnerability exists due to improper authorization checks within a key API endpoint responsible for user role management. An authenticated attacker with basic user permissions can craft a malicious API request to modify their own account's role, elevating their privileges to System Administrator. This exploit does not require any user interaction beyond the attacker having a valid, low-privileged account on the target Mattermost instance.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.6. Exploitation could have a significant business impact, allowing an attacker with administrative privileges to access all private channels and direct messages, exfiltrate sensitive corporate data, modify or delete critical information, and impersonate any user. This poses a direct risk to data confidentiality, integrity, and availability, potentially leading to regulatory fines, reputational damage, and disruption of business operations that rely on the Mattermost platform.

Remediation Plan

Immediate Action: Organizations must apply the security updates provided by Mattermost to all affected instances immediately. After patching, it is crucial to monitor for any signs of post-patch exploitation attempts and thoroughly review access logs for any unusual administrative activity, such as unexpected role changes, that occurred prior to the patch application.

Proactive Monitoring: Security teams should monitor application and web server logs for unusual or malformed API requests, particularly those targeting user profile or role management endpoints. Implement alerts for any unexpected changes to user roles, especially elevations to 'System Admin'. Review audit logs for unauthorized administrative actions or logins from suspicious IP addresses.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) rule to block or alert on malicious requests targeting the vulnerable API endpoint. Enforce the principle of least privilege by auditing all user accounts and removing unnecessary permissions. Increase the scrutiny and monitoring of all administrative accounts and actions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 15, 2025, there are no known public proof-of-concept exploits or observed instances of active exploitation in the wild. However, due to the nature of privilege escalation vulnerabilities, it is highly likely that threat actors will develop exploits in the near future.

Analyst Recommendation

Given the High severity rating (CVSS 7.6) and the critical role Mattermost plays in enterprise communication, it is strongly recommended that organizations prioritize the deployment of vendor-supplied patches to all vulnerable systems without delay. Although this CVE is not currently listed on the CISA KEV catalog, its potential for enabling a complete system compromise warrants immediate attention to prevent future exploitation and protect sensitive corporate data.