CVE-2026-16044 in Mattermost
Summary
by MITRE • 08/17/2026
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Mattermost versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 represents a critical privilege escalation flaw within the platform's board management subsystem, specifically triggered during the import of archived boards. This issue stems from an insufficient validation mechanism when processing .boardarchive files, which are used to backup or migrate workspace configurations and content. The core technical failure lies in the application's inability to correctly enforce role-based access control policies during this specific operation, allowing a user with board member privileges to manipulate the import process to assign administrative rights on that board to users who should only possess guest-level permissions. This misconfiguration effectively bypasses the intended security boundaries between different tiers of user interaction within the workspace structure.
From an operational perspective, this flaw allows for unauthorized privilege escalation where a standard board member can elevate a guest account to the status of Board Admin. In the context of Mattermost's collaborative environment, Board Administrators typically hold elevated privileges such as the ability to modify board settings, manage permissions for other members, delete content, and potentially access sensitive information stored within that specific workspace area. By granting these rights to a guest user, who is generally restricted from performing administrative actions or viewing certain private channels, an attacker can gain unauthorized control over critical project data. This escalation compromises the integrity of the collaboration space, as the elevated guest account can now alter configurations, remove restrictions on other users, and potentially exfiltrate sensitive information that was previously protected by their lower privilege level.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically highlighting a failure to enforce proper role-based access control during state changes or data imports. Furthermore, the attack vector corresponds to MITRE ATT&CK technique T1078, Valid Accounts, as it involves using legitimate but improperly escalated credentials to gain unauthorized access and maintain persistence within the system's administrative functions. The exploitation requires only a crafted .boardarchive file imported by an existing board member, making it relatively straightforward for any user with basic membership rights in a vulnerable instance to execute this attack without requiring external network exploits or complex social engineering beyond the initial import action.
To mitigate this risk, organizations running affected versions of Mattermost must prioritize immediate patching to the latest stable release where this logic error has been corrected. Administrators should verify that their instances are updated past version 11.7.6 and 10.11.21 respectively, as referenced in Advisory ID MMSA-2026-00672. In addition to software updates, it is advisable for administrators to review recent import logs for any suspicious board archive imports that resulted in unexpected permission changes. Implementing stricter monitoring on privilege modification events and enforcing the principle of least privilege by regularly auditing user roles can further reduce the attack surface should similar vulnerabilities arise in future releases.