Executive brief
Mattermost is an open-source team communication platform used for internal messaging and collaboration. A missing authorization check allows User Managers with write access to user data but no integration permissions to disable bot accounts via an API endpoint. An attacker with these limited privileges can deactivate automated bot accounts that may be critical to business workflows, disrupting integrations and automation.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in Mattermost's API permission model. The PUT /api/v4/users/{id}/active endpoint fails to enforce proper role-based access control for bot accounts, allowing users with user management write permissions but no integration management rights to modify bot status. The attack requires network access to the Mattermost API and authentication as a User Manager account, but no additional user interaction. An attacker can deactivate bot accounts, disrupting automations and integrations that depend on those bots. Patches are available in Mattermost 11.7.1 and 10.11.18.
Affected products
- Mattermost Mattermost Server 11.7.0 <= 11.7.x; 10.11.0 <= 10.11.17
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database and NVD
- 2026-06-22: patched: Fix available in Mattermost 11.7.1 and 10.11.18
- 2026-09-15: advisory: GitHub security review completed