# CVE-2026-8823: Mattermost incorrect authorization in demote-user API

Source: https://junglewise.ai/threats/cve-2026-8823-mattermost-incorrect-authorization-in-demote-user-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-8823 · Severity: low · CVSS 3.8 · Published 2026-06-22

Mattermost is a collaboration platform used for team communication and incident response. A vulnerability in the user management system allows administrators with lower privileges to demote automated bot accounts to guest status. This could disrupt automated workflows, integrations, and security monitoring tools that rely on these bot accounts to function correctly.

Technologies: [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server), [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5), [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6), [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8), [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-8823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8823 being exploited in the wild.

**How severe is CVE-2026-8823?** Low severity, with a CVSS score of 3.8, published 22 June 2026.

**Which products and versions are affected?** github.com/mattermost/mattermost-server (Go) SEMVER:introduced=10.11.0+incompatible,fixed=10.11.18+incompatible,introduced=11.7.0+incompatible,fixed=11.7.1+incompatible, SEMVER:introduced=11.7.0,fixed=11.7.1; github.com/mattermost/mattermost-server/v5 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost-server/v6 (Go) SEMVER:introduced=0; github.com/mattermost/mattermost/server/v8 (Go) SEMVER:introduced=0,fixed=8.0.0-20260518160100-9bd77d3fc4d2; and 1 more.

**Is there a fix for CVE-2026-8823?** Yes. github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later; github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260518160100-9bd77d3fc4d2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8823 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8823?** Check whether you run github.com/mattermost/mattermost-server (Go), github.com/mattermost/mattermost-server/v5 (Go), github.com/mattermost/mattermost-server/v6 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mattermost/mattermost-server (Go): upgrade to 11.7.1, 11.7.1+incompatible or later

  ```sh
  go get github.com/mattermost/mattermost-server@v11.7.1+incompatible
  ```

- github.com/mattermost/mattermost/server/v8 (Go): upgrade to 8.0.0-20260518160100-9bd77d3fc4d2 or later

  ```sh
  go get github.com/mattermost/mattermost/server/v8@v8.0.0-20260518160100-9bd77d3fc4d2
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the demote-user API of Mattermost Server. The application fails to properly validate whether a target account is a bot when an administrator attempts to demote a user to a guest role. This allows a high-privileged user (specifically a lower-level administrator) to target and demote arbitrary bot accounts, effectively degrading their permissions and potentially breaking automated integrations. The attack is reachable over the network without user interaction, though it requires administrative privileges. Patches are available in versions 11.8.0, 11.7.1, and 10.11.18.

## Affected products

- Mattermost Mattermost Server 11.7.x <= 11.7.0, 10.11.x <= 10.11.17

## Identifiers

- CVE-2026-8823
- GHSA-xmfh-3ccg-c9fx
- GO-2026-6547

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: advisory

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)