CVE-2026-8074: Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint

June 22, 2026 (updated September 15, 2026)

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

References

github.com/advisories/GHSA-g5vr-6pgg-74qv
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2026-8074

Code Behaviors & Features

Detect and mitigate CVE-2026-8074 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →