CVE-2026-7387: Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints
(updated )
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests. Mattermost Advisory ID: MMSA-2026-00665
References
- github.com/advisories/GHSA-6hxm-w4hv-vgvw
- github.com/mattermost/mattermost/commit/1ce2484a00c9821ee19708d2c46720e4855033a9
- github.com/mattermost/mattermost/commit/202d125afa87fe39611686850fd82590c99ca344
- github.com/mattermost/mattermost/commit/8c72083414e675c97987374395e36d1f36b4bd8a
- github.com/mattermost/mattermost/commit/a9e574a82633915f22071f0d7ca2b006f249ec2a
- github.com/mattermost/mattermost/commit/d5f29c8ebbeb04460d16d9e2635ce50deeb78428
- github.com/mattermost/mattermost/pull/36316
- github.com/mattermost/mattermost/pull/36423
- github.com/mattermost/mattermost/pull/36431
- github.com/mattermost/mattermost/pull/36432
- github.com/mattermost/mattermost/pull/36434
- github.com/mattermost/mattermost/releases/tag/v10.11.16
- github.com/mattermost/mattermost/releases/tag/v11.5.5
- github.com/mattermost/mattermost/releases/tag/v11.6.2
- github.com/mattermost/mattermost/releases/tag/v11.7.0
- mattermost.com/security-updates
- nvd.nist.gov/vuln/detail/CVE-2026-7387
Code Behaviors & Features
Detect and mitigate CVE-2026-7387 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →