CVE-2026-18551Medium· 6.5▾ SunlitMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
Mattermost >= 11.10.0 <= 11.10.0Mattermost >= 11.7.0 <= 11.7.9Mattermost >= 11.9.0 <= 11.9.1Mattermost >= 11.8.0 <= 11.8.5Update Mattermost to versions 11.11.0, 11.10.1, 11.7.10, 11.9.2, 11.8.6 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19076Medium· 4.4Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
CVE-2026-18256Medium· 4.3Private team metadata disclosure via the team search API
CVE-2026-18223Medium· 5.0Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
CVE-2026-19541Medium· 6.5Outgoing OAuth connection client secret exposure during connection validation
CVE-2026-19601Medium· 4.9Disclosure of AD/LDAP bind password via Test Connection
CVE-2026-19867Medium· 4.3Uncapped mention keys in user notification properties allow CPU exhaustion during post processing