CVE-2026-8823: Mattermost has an Incorrect Authorization issue
(updated )
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Mattermost Advisory ID: MMSA-2026-00669
References
- docs.mattermost.com/security-guide/security-updates
- github.com/advisories/GHSA-xmfh-3ccg-c9fx
- github.com/mattermost/mattermost/commit/7972fc53f5c0b0175879a9737308a87b42db1f0b
- github.com/mattermost/mattermost/commit/9bd77d3fc4d2af3f7f0259a205174e76a1a276e1
- github.com/mattermost/mattermost/commit/c9bf3609fb9a3e5c2de94c50742c9b91fd723e3d
- github.com/mattermost/mattermost/commit/d9a55e394cd5bc15edb49e9606bec8fec03ac4c6
- github.com/mattermost/mattermost/pull/36487
- github.com/mattermost/mattermost/releases/tag/v10.11.18
- github.com/mattermost/mattermost/releases/tag/v11.7.1
- nvd.nist.gov/vuln/detail/CVE-2026-8823
Code Behaviors & Features
Detect and mitigate CVE-2026-8823 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →