CVE-2026-26230 — Team Admin Privilege Escalation to Demote Members to Guest
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote member…
Published: 2026-03-16 · CVSS: 3.8 · CVSS 3.1
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7