{"id":"CVE-2026-93846","aliases":[],"title":"Team admin can escalate a team member's permissions via the team member roles endpoint","titleSource":"Mattermost","descriptionSource":"Mattermost","products":[{"vendor":"Mattermost","name":"Mattermost","platforms":[],"versions":[{"version":"11.7.0","status":"affected","lessThanOrEqual":"11.7.10","versionType":"semver"},{"version":"11.11.0","status":"unaffected"},{"version":"11.7.11","status":"unaffected"}],"defaultStatus":"unaffected","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93846"}],"remediation":[{"text":"Update Mattermost to versions 11.11.0, 11.7.11 or higher.","source":"Mattermost","url":"https://www.cve.org/CVERecord?id=CVE-2026-93846"}],"description":"Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API.. Mattermost Advisory ID: MMSA-2026-00734","severity":"low","score":3.8,"published":"2026-10-26T15:58:14.443Z","modified":"2026-10-26T15:58:14.443Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://mattermost.com/security-updates"],"sources":[{"name":"CVE","id":"CVE-2026-93846","modified":"2026-10-26T15:58:14.443Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93846"}],"assessments":[{"source":"Mattermost","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.8}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:15:31.428Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}