CVE-2026-9816

Imagine Mattermost has a “board member role” setting, but the server doesn’t properly double-check what role value someone asks for. A person who can edit board or member details could potentially change those role values to give board-admin power to other users. That kind of access is like getting the keys to the office desk drawers—once someone has the admin role, they can do things they weren’t supposed to.

This matters if you run Mattermost server (including any Mattermost server that manages boards and board/team members). If an attacker can reach the relevant API actions through normal authenticated use (for example, as a board editor or a non-guest team member), they may be able to escalate their privileges by changing board/admin role fields. There’s no public indication of exploitation in the findings, but this is still an update-worthy server-side validation issue for deployments with users who can edit boards or team membership.

This is urgent enough to act on now because the weakness is directly about privilege escalation to board-admin access, which can lead to unauthorized administrative actions if abused. The findings do not list it in CISA KEV and do not show public exploit code, so it’s not “panic,” but the correct response is to update to the fixed Mattermost versions promptly.

Confirm exposure

1. Identify the exact Mattermost server version currently running.
2. Determine whether your version is below the fixed releases listed by the vendor: 11.9.0, 11.7.7, 10.11.22, or 11.8.4.

Upgrade to the fixed version

1. Choose the fixed version that matches your release line:
   • Upgrade to Mattermost 11.9.0 or higher, or
   • 11.7.7 or higher, or
   • 11.8.4 or higher, or
   • 10.11.22 or higher.
2. Plan downtime/maintenance consistent with your normal Mattermost update process.
3. After upgrading, confirm your board/member features are working and that role assignment changes only occur for intended users.

Temporary workaround (if patching is delayed)

• Restrict who can edit boards and who can make membership changes related to boards/teams. Since the issue involves authenticated users with sufficient access to board/member role actions, reducing who has those permissions lowers exposure while you schedule the fixed upgrade.

What to monitor

• Review recent board membership and role-change activity for any unexpected board-admin assignments or changes made by users who normally do not perform these actions.

Timing

• No CISA KEV due date was provided in the findings (not listed in CISA KEV). Use your standard patch window as quickly as possible given the privilege escalation impact.

Severity and weakness

• Reported as HIGH (CVSS 8.3) with CWE-863 (insufficient server-side validation).

Mechanism / attack path

• The server fails to validate board member role fields server-side on insert and archive-import paths.
• This can allow an authenticated user with board/member editing capabilities (described in the backstop as a board editor or non-guest team member) to grant board admin to arbitrary users via board membership/role-changing API requests (including POST /api/v2/boards/{boardID}/members and archive import endpoints).

Exploitation status

• Not listed in CISA KEV.
• No public exploit code is on record.

EPSS

• A predicted EPSS of 0.3% was provided in the findings, with a flat trend; however, the findings do not indicate confirmed exploitation.

Fix

• Vendor-provided fixed versions are available; upgrading to one of the listed fixed releases (or higher) remediates the issue.

References

• Mattermost Advisory ID: MMSA-2026-00685.