CVE-2026-10527mediumCWE-863

Boards plugin retains Board Admin rights for users demoted to System Guest

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.2%

probabilidade de exploração

0.2%top 95% das CVEs

exploração observada

nãonenhuma fonte reporta

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

Mattermost · Mattermost

Referências

https://mattermost.com/security-updates