CVE-2026-6739: Mattermost: Delegated admins could patch protected default system roles
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.. Mattermost Advisory ID: MMSA-2026-00656
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.6.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.5.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.16 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.17 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Patch MMSA-2026-00656
Event History
Frequently Asked Questions
What is CVE-2026-6739?
CVE-2026-6739 is a vulnerability in Mattermost that allows authenticated users with delegated user-management permissions to escalate privileges when patching protected default system roles.
What is the severity of CVE-2026-6739?
CVE-2026-6739 has a medium severity rating of 6.7.
How do I fix CVE-2026-6739?
To fix CVE-2026-6739, update Mattermost to versions 11.7.0, 11.6.2, 11.5.5, 10.11.16, 10.11.17 or higher.
Who is affected by CVE-2026-6739?
CVE-2026-6739 affects users of Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.15 and 10.11.16.
What are the potential consequences of CVE-2026-6739?
The potential consequences of CVE-2026-6739 include unauthorized privilege escalation for users with limited permissions.