CVE-2026-93846
LOW
NVD
CVSS Score
3.8
Severity
LOW
Published
Oct 26, 2026
Vendor
unknown
Description
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the { {update-team-member-roles} } REST API.. Mattermost Advisory ID: MMSA-2026-00734