CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest
Team administrators can improperly demote members to guest role due to insufficient permission validation in the API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26230?
CVE-2026-26230 is a low-severity vulnerability in Mattermost Mattermost Server, published on 16 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
Weakness: CWE-863
Which versions are affected by CVE-2026-26230?
It affects 1 product.
Products include Mattermost Mattermost Server.
How do I fix CVE-2026-26230?
No fix has been published for CVE-2026-26230 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-26230 being exploited?
There is no known exploitation of CVE-2026-26230 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Mattermost Server
- CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-12421 Account Takeover via Code Exchange Endpoint
- CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
Sources
Also known as GHSA-q6ph-8227-6m8x.