---
id: CVE-2026-6739
aliases:
  - GHSA-m2w9-h2mm-79qr
title: >-
  Mattermost doesn't require system-level permission when patching protected
  default system roles
summary: >-
  Mattermost doesn't require system-level permission when patching protected
  default system roles
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L'
vendor: mattermost
product: github.com/mattermost/mattermost-server
ecosystem: go
affected:
  - 'github.com/mattermost/mattermost-server >= 11.6.0, < 11.6.1'
  - 'github.com/mattermost/mattermost-server >= 11.5.0, < 11.5.5'
  - 'github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.17'
  - >-
    github.com/mattermost/mattermost/server/v8 >=
    8.0.0-20250731163400-5b955468ea1e, < 8.0.0-20260501142004-99b73d4c4acf
patched:
  - github.com/mattermost/mattermost-server 11.6.1
  - github.com/mattermost/mattermost-server 11.5.5
  - github.com/mattermost/mattermost-server 10.11.17
  - github.com/mattermost/mattermost/server/v8 8.0.0-20260501142004-99b73d4c4acf
published: '2026-06-12'
updated: '2026-08-24'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m2w9-h2mm-79qr'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-6739'
  - url: 'https://github.com/mattermost/mattermost/pull/36197'
  - url: 'https://github.com/mattermost/mattermost/pull/36377'
  - url: 'https://github.com/mattermost/mattermost/pull/36379'
  - url: 'https://github.com/mattermost/mattermost/pull/36380'
  - url: 'https://github.com/mattermost/mattermost/pull/36382'
  - url: >-
      https://github.com/mattermost/mattermost/commit/2c89c2f6768fbe4dfd57a21ca38c0aecead8d4a8
  - url: >-
      https://github.com/mattermost/mattermost/commit/5e159647b16e571b327ac6882f32eae42971f540
  - url: >-
      https://github.com/mattermost/mattermost/commit/8000e5933526f4fd66b92131db3a1b1f4520dbae
  - url: >-
      https://github.com/mattermost/mattermost/commit/f0a390b96e4c730daedbaf5190684776730218c7
  - url: 'https://github.com/mattermost/mattermost'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v10.11.16'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.5.5'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.6.2'
  - url: 'https://github.com/mattermost/mattermost/releases/tag/v11.7.0'
  - url: 'https://mattermost.com/security-updates'
tags:
  - osv
  - go
epss: 0.00462
epssPercentile: 0.37418
ingestedAt: '2026-08-25T19:26:23.155Z'
---

## Overview

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API. Mattermost Advisory ID: MMSA-2026-00656

## Affected packages

- `github.com/mattermost/mattermost-server >= 11.6.0, < 11.6.1`
- `github.com/mattermost/mattermost-server >= 11.5.0, < 11.5.5`
- `github.com/mattermost/mattermost-server >= 10.11.0, < 10.11.17`
- `github.com/mattermost/mattermost/server/v8 >= 8.0.0-20250731163400-5b955468ea1e, < 8.0.0-20260501142004-99b73d4c4acf`

## Remediation

Upgrade to a patched release:

- `github.com/mattermost/mattermost-server 11.6.1`
- `github.com/mattermost/mattermost-server 11.5.5`
- `github.com/mattermost/mattermost-server 10.11.17`
- `github.com/mattermost/mattermost/server/v8 8.0.0-20260501142004-99b73d4c4acf`