Junglewise Threat Intelligence

CVE-2026-9859: Mattermost privilege escalation in board channel reassignment

CVE-2026-9859 · Severity: medium · CVSS 6.5 · Published 2026-08-17

Technologies: Mattermost Server. Vendors: Mattermost.

Executive brief

Mattermost is a popular team collaboration platform similar to Slack. A flaw in versions 11.7.x, 10.11.x, and 11.8.x allows authenticated board editors to reassign any board they can edit to an arbitrary channel by bypassing permission checks. An attacker with board editor privileges could move boards to channels they should not have access to, potentially exposing or disrupting collaborative workspace data.

Technical details

The vulnerability is a privilege escalation flaw caused by failure to enforce the PermissionManageBoardRoles permission check on the channelId field of the batch PATCH endpoint. An authenticated user with board editor privileges can craft a PATCH request to relink any board under their control to an arbitrary channel, circumventing authorization controls. The attack requires prior board editor access and network connectivity to the Mattermost server. No patches are explicitly mentioned in the advisory, but the affected versions are clearly defined (11.7.x ≤ 11.7.6, 10.11.x ≤ 10.11.21, 11.8.x ≤ 11.8.3).

Affected products

  • Mattermost Mattermost Server 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3

Timeline

  • 2026-08-17: disclosed

References

Related threats