Is CVE-2026-6739 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6739 being exploited in the wild.

How severe is CVE-2026-6739?

Medium severity, with a CVSS score of 6.7, published 12 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260501142004-99b73d4c4acf; and 1 more.

Is there a fix for CVE-2026-6739?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260501142004-99b73d4c4acf or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6739 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-6739?

Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6739: Mattermost privilege escalation in role patch API

CVE-2026-6739 · Severity: medium · CVSS 6.7 · Published 2026-06-12

Mattermost, a team collaboration platform, fails to properly validate authorization when users modify built-in system roles through its API. Authenticated users with basic user-management delegated permissions can exploit this to escalate their own privileges by altering role permissions, allowing them to gain system-level access they should not have. This could enable unauthorized users to access sensitive administrative functions and compromise the security of the entire collaboration platform.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-6739 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6739 being exploited in the wild.
How severe is CVE-2026-6739?: Medium severity, with a CVSS score of 6.7, published 12 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260501142004-99b73d4c4acf; and 1 more.
Is there a fix for CVE-2026-6739?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260501142004-99b73d4c4acf or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6739 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-6739?: Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
```
github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260501142004-99b73d4c4acf or later
```
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260501142004-99b73d4c4acf
```

Technical details

This is an incorrect authorization vulnerability (CWE-863) in Mattermost's role-based access control (RBAC) system. The root cause is insufficient permission validation in the role patch API endpoint when modifying protected default system roles (such as system_user and system_guest). An authenticated user holding lower-level delegated user-management permissions can directly patch these built-in roles to add sensitive permissions they lack, effectively escalating to higher-privileged roles. The attack requires valid authentication but no additional user interaction, and network reachability to the Mattermost API. An attacker can achieve privilege escalation and gain unauthorized access to administrative functionality. Patches are available: versions 10.11.17, 11.5.5, 11.6.2, and 11.7.0 contain fixes that tighten authorization checks and require PermissionManageSystem for protected role modifications.

Affected products

Mattermost Mattermost Server 11.6.0, 11.6.1, 11.5.0–11.5.4, 10.11.0–10.11.15, 10.11.16

Identifiers

CVE-2026-6739
GHSA-m2w9-h2mm-79qr
GO-2026-6285

Timeline

2026-06-12: disclosed: Advisory published by GitHub and NVD
2026-05-01: patched: Fix merged in PR #36197 on master branch (May 1, 2026)
2026-05-04: patched: Cherry-picked to release branches 11.7, 11.6, 11.5 (May 4, 2026)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.