CVE-2026-16044
published 2026-08-17CVE-2026-16044: Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
0.29%
20.1th percentile
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mattermost | mattermost | 10.11.0 – 10.11.21 | — |
| mattermost | mattermost | 11.7.0 – 11.7.6 | — |
| mattermost | mattermost_server | >= 10.11.0 < 10.11.22 | 10.11.22 |
| mattermost | mattermost_server | >= 11.7.0 < 11.7.7 | 11.7.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 10.11.21/11.7.6 Board privileges management (Nessus ID 338331)
vuldb·2026-08-21·CVSS 5.4
CVE-2026-16044 [MEDIUM] Mattermost up to 10.11.21/11.7.6 Board privileges management (Nessus ID 338331)
A vulnerability marked as problematic has been reported in Mattermost up to 10.11.21/11.7.6. Impacted is an unknown function of the component Board. This manipulation causes improper privilege management.
This vulnerability is tracked as CVE-2026-16044. The attack is possible to be carried out remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest
ghsa_unreviewed·2026-08-17
CVE-2026-16044 [MEDIUM] CWE-863 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-17
Published