CVE-2026-18551: Mattermost guest account privilege escalation via member roles API
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which allows an authenticated attacker to escalate a guest account to team or channel admin via a crafted PUT request to the member roles API endpoint.. Mattermost Advisory ID: MMSA-2026-00752
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must already be authenticated to Mattermost and able to send a crafted PUT request to the member roles API endpoint. The vulnerability is rated with high privileges required, so it is not an unauthenticated attack.
Which deployments are affected?
Affected releases are Mattermost 11.10.0 and earlier 11.10.x versions, 11.7.9 and earlier 11.7.x versions, 11.9.1 and earlier 11.9.x versions, and 11.8.5 and earlier 11.8.x versions. The issue concerns environments where guest and administrator scheme roles can be combined through the member roles API.
What level of access can be gained?
A successful attacker can escalate a guest account to a team administrator or channel administrator role. This can result in high confidentiality and integrity impact, while no availability impact is identified.