Is CVE-2026-7387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7387 being exploited in the wild.

How severe is CVE-2026-7387?

High severity, with a CVSS score of 8.8, published 12 June 2026.

Which products and versions are affected?

github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260506065351-202d125afa87; and 1 more.

Is there a fix for CVE-2026-7387?

Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260506065351-202d125afa87 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7387 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-7387?

Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpoints

CVE-2026-7387 · Severity: high · CVSS 8.8 · Published 2026-06-12

Mattermost, a popular open-source team collaboration platform, fails to properly enforce role-management authorization checks on API endpoints that manage group permissions for teams and channels. An attacker with basic group-link permissions can craft API requests to escalate themselves and other group members to team or channel administrator status without proper authorization, gaining control over team/channel settings and member access.

Technologies: github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go), github.com/mattermost/mattermost/server/v8 (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-7387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7387 being exploited in the wild.
How severe is CVE-2026-7387?: High severity, with a CVSS score of 8.8, published 12 June 2026.
Which products and versions are affected?: github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260506065351-202d125afa87; and 1 more.
Is there a fix for CVE-2026-7387?: Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260506065351-202d125afa87 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7387 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-7387?: Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later
```
go get github.com/mattermost/mattermost-server@v11.6.1+incompatible
```
github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260506065351-202d125afa87 or later
```
go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260506065351-202d125afa87
```

Technical details

This is an authorization bypass vulnerability (CWE-863) in Mattermost's group synchronization API endpoints. The group syncable link and patch endpoints fail to validate whether the caller holds role-management permissions before allowing the scheme_admin flag to be set on group members. An authenticated user with group-link permissions can send crafted API requests to escalate privileges for themselves and group members to team or channel administrator level, bypassing the intended authorization model. The vulnerability requires low privileges (group-link access) and no user interaction. Patches were released in versions 10.11.17, 11.5.5, 11.6.2, and 11.7.0, adding explicit permission checks requiring the caller to hold the role-management permission for the target team/channel or the sysconsole groups-management permission.

Affected products

Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 10.11.0 to 10.11.16

Identifiers

CVE-2026-7387
GHSA-6hxm-w4hv-vgvw
GO-2026-6280

Timeline

2026-06-12: disclosed: Vulnerability published in GitHub Advisory Database
2026-05-05: patched: Fixes merged into release branches (v10.11.17, v11.5.5, v11.6.2, v11.7.0)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.