CVE-2026-26230
Team Admin Privilege Escalation to Demote Members to Guest
Summary
Team Admin Privilege Escalation to Demote Members to Guest
Original description
The description as published by the source.
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
References
- advisory github.com
- advisory mattermost.com
- advisory nvd.nist.gov