CVE-2026-26230 — Incorrect Authorization in Server

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
3.8LOWNVD
EPSS
0.0%
top 90.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mattermost ServerMattermost
Timeline
PublishedMar 16

Description

Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NExploitability: 1.2 | Impact: 2.5

Affected Packages2 packages

▶NVDmattermost/mattermost_server10.11.0 — 10.11.11
▶CVEListV5mattermost/mattermost10.11.0 — 10.11.10

🔴Vulnerability Details

2
GHSA
GHSA-q6ph-8227-6m8x: Mattermost versions 10↗2026-03-16
▶
CVEList
Team Admin Privilege Escalation to Demote Members to Guest↗2026-03-16
▶
CVE-2026-26230 — Incorrect Authorization in Server | cvebase