CVE-2026-15754
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 fail to re-validate that each target channel still belongs to the requesting admin's team when calling the policy unassign endpoint. This allows an authenticated team administrator to remove ABAC policy assignments from channels outside their team after a channel has been moved to another team.
Risk Assessment
The risk includes unauthorized removal of access policies from channels, potentially compromising access control and data security.
Recommendation
Upgrade Mattermost to a version that fixes this vulnerability (as per vendor recommendations).
Original NVD description (English source)
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718