{"id":"CVE-2026-93846","title":"Team admin can escalate a team member's permissions via the team member roles endpoint","summary":"Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission sc…","severity":"low","cvss":3.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-863"],"vendor":"Mattermost","product":"Mattermost","affected":["Mattermost >= 11.7.0 <= 11.7.10"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T15:58:14.443Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93846","references":[{"url":"https://mattermost.com/security-updates","label":"MMSA-2026-00734"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T16:31:40.063Z","slug":"CVE-2026-93846","body":"## Overview\n\nMattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734\n\n## Affected\n\n- `Mattermost >= 11.7.0 <= 11.7.10`\n\n## Remediation\n\nUpdate Mattermost to versions 11.11.0, 11.7.11 or higher.","depth":"sunlit","depthScore":21,"depthScoreParts":{"impact":20.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}