CVE-2026-16044 — Insufficient validation of guest board admin privileges on archive import
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board memb…
Published: 2026-08-17 · CVSS: 3.9 · CVSS 3.1
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7