PT-2026-25813 · Mattermost · Mattermost

Hackit_Bharat · Published 2026-02-13 · Updated 2026-03-17 · CVE-2026-26230

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10

Description Mattermost versions 10.11.x up to and including 10.11.10 do not correctly validate permission requirements in the team member roles API endpoint. This allows team administrators to demote members to a guest role. The affected API endpoint is '/api/v1/teams/{team id}/members/{user id}/roles', where team id and user id are vulnerable parameters.

Recommendations Update Mattermost to a version later than 10.11.10.

Fix

LPE

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

BDU:2026-06556

CVE-2026-26230

Affected Products

Mattermost

References · 6

• https://osv.dev/vulnerability/CVE-2026-26230 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26230 · Security Note
• https://bdu.fstec.ru/vul/2026-06556 · Security Note
• https://twitter.com/VulmonFeeds/status/2033751028642844863 · Twitter Post
• https://twitter.com/CVEnew/status/2033755318736335209 · Twitter Post