CVE-2026-16048
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles, which allows a channel administrator to gain additional channel permissions via the channel member roles API.
Risk Assessment
The risk is privilege escalation within a channel, potentially leading to unauthorized administrative actions in channels.
Recommendation
Upgrade Mattermost to a version that fixes this vulnerability (as per vendor recommendations).
Original NVD description (English source)
Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697