CVE-2026-8074: Mattermost incorrect authorization in user active status endpoint

CVE-2026-8074 · Severity: low · CVSS 3.8 · Published 2026-06-22

Mattermost is an open-source team communication platform used for internal messaging and collaboration. A missing authorization check allows User Managers with write access to user data but no integration permissions to disable bot accounts via an API endpoint. An attacker with these limited privileges can deactivate automated bot accounts that may be critical to business workflows, disrupting integrations and automation.

Technologies: github.com/mattermost/mattermost-server (Go), Mattermost Server. Vendors: Go, Mattermost.

Quick answers

Is CVE-2026-8074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8074 being exploited in the wild.
How severe is CVE-2026-8074?
Low severity, with a CVSS score of 3.8, published 22 June 2026.
Which products and versions are affected?
github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; Mattermost Server 11.7.0 <= 11.7.x; 10.11.0 <= 10.11.17, 11.7.x <= 11.7.0, 10.11.x <= 10.11.17.
Is there a fix for CVE-2026-8074?
Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8074 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-8074?
Check whether you run github.com/mattermost/mattermost-server (Go) or Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later
    go get github.com/mattermost/mattermost-server@v11.7.1+incompatible

Technical details

This is an incorrect authorization vulnerability (CWE-863) in Mattermost's API permission model. The PUT /api/v4/users/{id}/active endpoint fails to enforce proper role-based access control for bot accounts, allowing users with user management write permissions but no integration management rights to modify bot status. The attack requires network access to the Mattermost API and authentication as a User Manager account, but no additional user interaction. An attacker can deactivate bot accounts, disrupting automations and integrations that depend on those bots. Patches are available in Mattermost 11.7.1 and 10.11.18.

Affected products

  • Mattermost Mattermost Server 11.7.0 <= 11.7.x; 10.11.0 <= 10.11.17

Identifiers

  • CVE-2026-8074
  • GHSA-g5vr-6pgg-74qv
  • GO-2026-6481

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-06-22: patched: Fix available in Mattermost 11.7.1 and 10.11.18
  • 2026-09-15: advisory: GitHub security review completed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.