PT-2026-25813 · Mattermost · Mattermost

Hackit_Bharat · Publicado 2026-02-13 · Atualizado 2026-03-17 · CVE-2026-26230

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10

Description Mattermost versions 10.11.x up to and including 10.11.10 do not correctly validate permission requirements in the team member roles API endpoint. This allows team administrators to demote members to a guest role. The affected API endpoint is '/api/v1/teams/{team id}/members/{user id}/roles', where team id and user id are vulnerable parameters.

Recommendations Update Mattermost to a version later than 10.11.10.

Correção

LPE

Improper Access Control

Incorrect Authorization

Enumeração de Fraquezas

CWE-284

CWE-863

Identificadores relacionados

BDU:2026-06556

CVE-2026-26230

Produtos afetados

Mattermost

Referências · 6

• https://twitter.com/VulmonFeeds/status/2033751028642844863 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26230 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2033755318736335209 · Publicação no Twitter
• https://mattermost.com/security-updates · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-26230 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-06556 · Nota de Segurança