CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint
Channel or team administrators can bypass ABAC restrictions by detaching system-assigned parent policies via a crafted API request.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82920?
CVE-2026-82920 is a medium-severity missing authorization vulnerability in Mattermost Mattermost Server, published on 14 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/access_control_policies request with an empty imports list.. Mattermost Advisory ID: MMSA-2026-00724
Weakness: CWE-863
Which versions are affected by CVE-2026-82920?
It affects 1 product.
Products include Mattermost Mattermost Server.
How do I fix CVE-2026-82920?
No fix has been published for CVE-2026-82920 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-82920 being exploited?
There is no known exploitation of CVE-2026-82920 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Mattermost Server
- CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-12421 Account Takeover via Code Exchange Endpoint
- CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
Sources
Also known as GHSA-v87m-p66q-xcjg.