CVE-2026-6739
published 2026-06-12CVE-2026-6739: Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching…
PriorityP339medium6.7CVSS 3.1
AVNACLPRHUINSUCHIHAL
EPSS
0.26%
17.3th percentile
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.. Mattermost Advisory ID: MMSA-2026-00656
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | mattermost_mattermost-server | >= 10.11.0 < 10.11.17 | 10.11.17 |
| github.com | mattermost_mattermost-server | >= 11.5.0 < 11.5.5 | 11.5.5 |
| github.com | mattermost_mattermost-server | >= 11.6.0 < 11.6.1 | 11.6.1 |
| github.com | mattermost_mattermost_server_v8 | >= 8.0.0-20250731163400-5b955468ea1e < 8.0.0-20260501142004-99b73d4c4acf | 8.0.0-20260501142004-99b73d4c4acf |
| mattermost | mattermost | 10.11.0 – 10.11.15 | — |
| mattermost | mattermost | 11.5.0 – 11.5.4 | — |
| mattermost | mattermost | 11.6.0 – 11.6.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Mattermost up to 11.6.x Role Patch API authorization
vuldb·2026-06-12·CVSS 6.7
CVE-2026-6739 [MEDIUM] Mattermost up to 11.6.x Role Patch API authorization
A vulnerability, which was classified as problematic, was found in Mattermost up to 10.11.15/10.11.16/11.5.4/11.6.1/11.6.x. The impacted element is an unknown function of the component Role Patch API. Such manipulation leads to incorrect authorization.
This vulnerability is uniquely identified as CVE-2026-6739. The attack can be launched remotely. No exploit exists.
You should upgrade the affected component.
GHSA
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows auth
ghsa_unreviewed·2026-06-12
CVE-2026-6739 [MEDIUM] CWE-863 Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows auth
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.. Mattermost Advisory ID: MMSA-2026-00656
GHSA
Mattermost doesn't require system-level permission when patching protected default system roles
ghsa·2026-06-12
CVE-2026-6739 [MEDIUM] CWE-863 Mattermost doesn't require system-level permission when patching protected default system roles
Mattermost doesn't require system-level permission when patching protected default system roles
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API. Mattermost Advisory ID: MMSA-2026-00656
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published