Executive brief
Mattermost, a team collaboration platform, fails to properly validate authorization when users modify built-in system roles through its API. Authenticated users with basic user-management delegated permissions can exploit this to escalate their own privileges by altering role permissions, allowing them to gain system-level access they should not have. This could enable unauthorized users to access sensitive administrative functions and compromise the security of the entire collaboration platform.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in Mattermost's role-based access control (RBAC) system. The root cause is insufficient permission validation in the role patch API endpoint when modifying protected default system roles (such as system_user and system_guest). An authenticated user holding lower-level delegated user-management permissions can directly patch these built-in roles to add sensitive permissions they lack, effectively escalating to higher-privileged roles. The attack requires valid authentication but no additional user interaction, and network reachability to the Mattermost API. An attacker can achieve privilege escalation and gain unauthorized access to administrative functionality. Patches are available: versions 10.11.17, 11.5.5, 11.6.2, and 11.7.0 contain fixes that tighten authorization checks and require PermissionManageSystem for protected role modifications.
Affected products
- Mattermost Mattermost Server 11.6.0, 11.6.1, 11.5.0–11.5.4, 10.11.0–10.11.15, 10.11.16
Timeline
- 2026-06-12: disclosed: Advisory published by GitHub and NVD
- 2026-05-01: patched: Fix merged in PR #36197 on master branch (May 1, 2026)
- 2026-05-04: patched: Cherry-picked to release branches 11.7, 11.6, 11.5 (May 4, 2026)