CVE-2026-93846Low· 3.8▾ SunlitMattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission sc…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734
Mattermost >= 11.7.0 <= 11.7.10Update Mattermost to versions 11.11.0, 11.7.11 or higher.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
CVE-2026-18551Medium· 6.5Mattermost guest account privilege escalation via member roles API
CVE-2026-19076Medium· 4.4Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token
CVE-2026-18256Medium· 4.3Private team metadata disclosure via the team search API
CVE-2026-18223Medium· 5.0Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
CVE-2026-93850Medium· 6.5Unbounded memory consumption during PDF text extraction