CVE-2026-26230CWE-863

Team Admin Privilege Escalation to Demote Members to Guest

Low · published March 16, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-16T20:19Z
EPSS history
Timeline
  • 16 MAR 20:19Z
    Team Admin Privilege Escalation to Demote Members to Guest
    cvelistv5