CVE-2026-15754 in Mattermost
Summary
by MITRE • 08/17/2026
Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Mattermost versions 11.7.x through 11.7.6 and 11.8.x through 11.8.3 represents a critical failure in access control logic, specifically within the administrative policy management subsystem. This flaw allows an authenticated team administrator to bypass intended security boundaries by manipulating Attribute-Based Access Control (ABAC) policies on channels that no longer belong to their respective teams. The core technical issue lies in the unassign endpoint of the ABAC policy API, which fails to perform a secondary validation check to confirm that the target channel remains associated with the requesting admin's team at the time of the request. In secure systems, access control decisions must be re-evaluated dynamically against current state data rather than relying on static assumptions made during initial authentication or session establishment. By omitting this critical verification step, the application permits actions that violate the principle of least privilege and proper tenant isolation in multi-tenant environments.
From a technical perspective, this vulnerability is classified under CWE-269 Improper Privilege Management because it allows an actor with lower-level privileges to perform administrative functions on resources outside their authorized scope. The attacker exploits the race condition or state inconsistency between channel ownership changes and policy assignment operations. When a channel is moved from one team to another, the system updates its internal metadata but does not invalidate existing session contexts or re-check permissions for subsequent API calls made by administrators of the original team. Consequently, an administrator who previously had control over a specific channel can continue to interact with that channel's policies even after losing ownership rights due to the transfer. This behavior undermines the integrity of ABAC implementations, which rely on accurate attribute mapping between users and resources to enforce security rules effectively.
The operational impact of this vulnerability is significant for organizations utilizing Mattermost in multi-team or enterprise configurations where strict separation of duties is required. An attacker with access to a compromised team administrator account can remove restrictive policies from channels belonging to other teams, potentially exposing sensitive communications, files, or configuration settings that were previously protected by ABAC rules. This could lead to unauthorized data disclosure, manipulation of communication workflows, or the establishment of persistent backdoors within shared infrastructure if policy changes allow unrestricted access to critical endpoints. Furthermore, this flaw erodes trust in administrative controls and complicates audit trails since actions are taken under valid credentials but against unintended targets.
To mitigate this risk, organizations running affected versions must immediately upgrade Mattermost to a patched version that addresses the validation logic in the unassign endpoint. Until an update is applied, administrators should restrict API access for team-level roles where possible and monitor logs for unusual policy modification activities involving channels outside expected teams. Security operations centers should also implement monitoring rules based on ATT&CK technique T1078 Valid Accounts to detect lateral movement or privilege escalation attempts via administrative interfaces. Regular reviews of ABAC policies and channel ownership assignments can help identify anomalies early, ensuring that access controls remain aligned with current organizational structures and security requirements.