CVE-2026-93846: Team admin can escalate a team member's permissions via the team member roles endpoint
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs team administrator privileges in Mattermost. They can then use the update-team-member-roles REST API to assign a team member built-in roles that exceed the permissions allowed by the configured permission scheme.
Which deployments are affected?
Mattermost 11.7.x through 11.7.10 are affected. The issue concerns deployments using the team member roles API and configured permission schemes that are intended to limit assignable built-in roles.
What is the impact of successful exploitation?
A team administrator can elevate another team member's permissions beyond the limits set by the configured permission scheme. The provided CVSS vector indicates low confidentiality and integrity impact, with no availability impact.