Mattermost: Twelve Vulnerabilities Disclosed, Including High-Severity Permission Flaws
Key findings • Twelve Mattermost vulnerabilities disclosed on August 17, 2026, span various features including Boards and core platform functions. • High severity CVE-2026-9816 allows imprope…
Key findings
- Twelve Mattermost vulnerabilities disclosed on August 17, 2026, span various features including Boards and core platform functions.
- High severity CVE-2026-9816 allows improper privilege escalation within the Boards feature.
- Low severity CVE-2026-9693 could expose private thread content due to improper membership record removal.
- Affected versions include Mattermost 10.11.x, 11.7.x, and 11.8.x, with patches available up to specific patch releases.
- The Mattermost GitLab plugin is also impacted by CVE-2026-16049, affecting permission verification and URL validation.
On August 17, 2026, a batch of twelve vulnerabilities was disclosed for Mattermost, a collaboration and communication platform. These vulnerabilities, disclosed within an eight-hour window, span various components of the Mattermost application and its plugins, with severities ranging from Low to High. The disclosures highlight potential issues with user permissions, data handling, and API security, underscoring the need for prompt patching to maintain system integrity and user data privacy.
Several vulnerabilities relate to the Mattermost Boards feature, impacting how users manage permissions and access data within boards and channels. CVE-2026-9859 and CVE-2026-9816, both rated Medium and High respectively, involve improper permission enforcement on board roles and the ability for users to grant administrative privileges to others. Specifically, CVE-2026-9859 allows an authenticated board editor to relink any editable board to an arbitrary channel. CVE-2026-9816 permits a board editor or non-guest team member to assign board admin roles to any user. Additionally, CVE-2026-10527 (Medium) details how a user demoted to System Guest could retain Board Admin privileges, allowing them to perform admin-only operations. CVE-2026-16044 (Medium) describes a scenario where guest users could be escalated to Board Admin during archive imports.
Further issues within the Boards feature include CVE-2026-16047 (Medium), which allows authenticated attackers to discover private channel memberships by linking boards without proper read access validation. CVE-2026-16046 (Medium) describes a flaw where participants could modify completed playbook runs due to a failure in run-state validation. CVE-2026-10080 (Medium) points to a denial-of-service vulnerability where an authenticated user could crash the plugin process by sending a malformed WebSocket message.
Beyond the Boards feature, other vulnerabilities affect core Mattermost functionality. CVE-2026-9693 (Low) involves Mattermost failing to remove thread membership records when a user leaves a team, potentially allowing re-invited users to view private channel thread content. CVE-2026-16048 (Medium) allows a channel administrator to gain additional channel permissions by bypassing restrictions on role assignments. CVE-2026-16045 (Medium) concerns the deauthorization of OAuth apps and personal access tokens, where an OAuth app could revoke a user's tokens for other integrations. Lastly, CVE-2026-15754 (Medium) allows a team administrator to remove access control policy assignments from channels without re-validating that the channels belong to their team. The Mattermost GitLab plugin is also affected by CVE-2026-16049 (Medium), which fails to verify channel permissions and validate web URLs, potentially allowing an authenticated attacker to gain unauthorized access.
The affected versions for these vulnerabilities vary, but generally include Mattermost versions 10.11.x up to 10.11.21, 11.7.x up to 11.7.6, and 11.8.x up to 11.8.3. Specific plugin versions are also noted for CVE-2026-16049. Users are advised to consult the official Mattermost advisories for precise version information and patching details.
These disclosures collectively highlight a broad range of security weaknesses within Mattermost, particularly concerning its permission models and API handling. The concentration of these issues in a single disclosure event emphasizes the importance of regular security audits and prompt application of patches by Mattermost users to safeguard against potential data breaches and unauthorized access.
The vulnerabilities disclosed on August 17, 2026, affect multiple Mattermost versions, including 10.11.x, 11.7.x, and 11.8.x. Several issues are related to the Mattermost Boards feature, impacting permission management and data access. CVE-2026-9816, a High severity vulnerability, allows improper privilege escalation within Boards. CVE-2026-9693, a Low severity vulnerability, could expose private thread content to re-invited users. The Mattermost GitLab plugin is also affected by CVE-2026-16049, with implications for channel permissions and URL validation. Patches are available for versions up to 10.11.21, 11.7.6, and 11.8.3, depending on the specific vulnerability.