# CVE-2026-9816: Mattermost privilege escalation via BoardMember.Scheme validation bypass

Source: https://junglewise.ai/threats/cve-2026-9816-mattermost-privilege-escalation-via-boardmember-scheme-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-9816 · Severity: high · CVSS 8.3 · Published 2026-08-17

Mattermost, a widely-deployed team collaboration platform, fails to properly validate board administrator permissions when importing teams or adding board members. An attacker with basic team member or board editor access can exploit this flaw to grant themselves admin rights on any board, potentially exposing sensitive team data or disrupting board operations. This affects multiple recent versions of the platform and is easily exploitable without special privileges.

Technologies: [Mattermost](https://junglewise.ai/threats/technologies/mattermost). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-9816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9816 being exploited in the wild.

**How severe is CVE-2026-9816?** High severity, with a CVSS score of 8.3, published 17 August 2026.

**Which products and versions are affected?** Mattermost 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3.

**Is there a fix for CVE-2026-9816?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9816 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9816?** Check whether you run Mattermost at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Mattermost's BoardMember.Scheme* field validation logic, which is missing server-side checks during member insertion and archive import operations. The flaw affects the POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import endpoints. A board editor or non-guest team member can craft requests to set BoardMember.Scheme* fields to admin values, bypassing role validation and granting board admin privileges to arbitrary users including themselves. The vulnerability requires network access to the Mattermost instance and an authenticated user account with basic team or board access, but no further privilege escalation is needed.

## Affected products

- Mattermost Mattermost 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3

## Timeline

- 2026-08-17: disclosed: CVE-2026-9816 publicly disclosed; Mattermost Advisory ID MMSA-2026-00685

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost permission bypass in board creation](https://junglewise.ai/threats/cve-2026-14344-mattermost-permission-bypass-in-board-creation)
- [Mattermost path traversal in file deletion endpoint](https://junglewise.ai/threats/cve-2026-7521-mattermost-path-traversal-in-file-deletion-endpoint)
- [Mattermost resource exhaustion in document content extraction](https://junglewise.ai/threats/cve-2026-10600-mattermost-resource-exhaustion-in-document-content-extraction)
- [Mattermost authorization bypass in Playbook metric configuration](https://junglewise.ai/threats/cve-2026-6541-mattermost-authorization-bypass-in-playbook-metric-configuration)
- [Mattermost ReDoS in client-side markdown parser](https://junglewise.ai/threats/cve-2026-6850-mattermost-redos-in-client-side-markdown-parser)