# CVE-2026-7387: Mattermost privilege escalation in group syncable link and patch endpoints Source: https://junglewise.ai/threats/cve-2026-7387-mattermost-privilege-escalation-in-group-syncable-link-and-patch Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-12. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-7387 · Severity: high · CVSS 8.8 · Published 2026-06-12 Mattermost, a popular open-source team collaboration platform, fails to properly enforce role-management authorization checks on API endpoints that manage group permissions for teams and channels. An attacker with basic group-link permissions can craft API requests to escalate themselves and other group members to team or channel administrator status without proper authorization, gaining control over team/channel settings and member access. Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5), [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6), [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost). ## Quick answers **Is CVE-2026-7387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7387 being exploited in the wild. **How severe is CVE-2026-7387?** High severity, with a CVSS score of 8.8, published 12 June 2026. **Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.17+incompatible,introduced=11.5.0+incompatible,fixed=11.5.5+incompatible,introduced=11.6.0+incompatible,fixed=11.6.1+incompatible, SEMVER:introduced=11.6.0,fixed=11.6.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=8.0.0-20250731163400-5b955468ea1e,fixed=8.0.0-20260506065351-202d125afa87; and 1 more. **Is there a fix for CVE-2026-7387?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260506065351-202d125afa87 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-7387 attacked?** It is attacked over the network, in a hosted service. **Am I affected by CVE-2026-7387?** Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/mattermost/mattermost-server (Go): upgrade to 11.6.1, 11.6.1+incompatible or later ```sh go get github.com/mattermost/mattermost-server@v11.6.1+incompatible ``` - github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260506065351-202d125afa87 or later ```sh go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260506065351-202d125afa87 ``` ## Technical details This is an authorization bypass vulnerability (CWE-863) in Mattermost's group synchronization API endpoints. The group syncable link and patch endpoints fail to validate whether the caller holds role-management permissions before allowing the scheme_admin flag to be set on group members. An authenticated user with group-link permissions can send crafted API requests to escalate privileges for themselves and group members to team or channel administrator level, bypassing the intended authorization model. The vulnerability requires low privileges (group-link access) and no user interaction. Patches were released in versions 10.11.17, 11.5.5, 11.6.2, and 11.7.0, adding explicit permission checks requiring the caller to hold the role-management permission for the target team/channel or the sysconsole groups-management permission. ## Affected products - Mattermost Mattermost Server 11.6.0 to 11.6.1, 11.5.0 to 11.5.4, 10.11.0 to 10.11.15, 10.11.0 to 10.11.16 ## Identifiers - CVE-2026-7387 - GHSA-6hxm-w4hv-vgvw - GO-2026-6280 ## Timeline - 2026-06-12: disclosed: Vulnerability published in GitHub Advisory Database - 2026-05-05: patched: Fixes merged into release branches (v10.11.17, v11.5.5, v11.6.2, v11.7.0) ## References - [https://mattermost.com/security-updates](https://mattermost.com/security-updates) - [https://github.com/mattermost/mattermost/pull/36316](https://github.com/mattermost/mattermost/pull/36316) - [https://github.com/mattermost/mattermost/pull/36423](https://github.com/mattermost/mattermost/pull/36423) - [https://github.com/mattermost/mattermost/pull/36431](https://github.com/mattermost/mattermost/pull/36431) - [https://github.com/mattermost/mattermost/pull/36432](https://github.com/mattermost/mattermost/pull/36432) ## Related threats - [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10) - [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11) - [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1) - [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)