CVE-2026-82920: Mattermost Authorization Bypass Vulnerability

CVE-2026-82920 Overview

CVE-2026-82920 is an authorization bypass vulnerability in Mattermost tracked under advisory MMSA-2026-00724. The flaw affects the access control policy update endpoint and allows channel or team administrators to detach a system-assigned Attribute-Based Access Control (ABAC) parent policy. Exploitation requires a crafted PUT /api/v4/access_control_policies request containing an empty imports list. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
A privileged administrator can strip system-assigned ABAC parent policies from channels or teams, weakening enforced access boundaries and altering the scope of user access controls.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4
Mattermost 11.7.x versions <= 11.7.7

Discovery Timeline

2026-09-14 - CVE-2026-82920 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82920

Vulnerability Analysis

Mattermost supports Attribute-Based Access Control (ABAC) through parent policies that administrators inherit and cannot modify directly. The affected endpoint PUT /api/v4/access_control_policies fails to enforce authorization boundaries when processing policy updates. A channel or team administrator can submit a request with an empty imports list, which removes the reference to the system-assigned parent policy.

Once the parent policy is detached, the previously enforced access rules no longer apply to that policy scope. This alters access boundaries and can expose resources that were previously restricted by centrally managed ABAC rules. The advisory identifier for this issue is MMSA-2026-00724.

Root Cause

The root cause is incorrect authorization enforcement [CWE-863] on the access control policy update handler. The endpoint accepts modifications to the imports field without validating whether the caller holds sufficient privileges to alter system-assigned parent policy relationships. Delegated administrators with channel or team scope can therefore modify state that should be reserved for system administrators.

Attack Vector

Exploitation requires an authenticated user with channel or team administrator privileges. The attacker issues a crafted PUT request to /api/v4/access_control_policies with an empty imports array. No user interaction is required beyond the API call. The Mattermost server processes the update, detaches the parent policy, and returns a successful response. Refer to the Mattermost Security Updates advisory for authoritative technical details.

Detection Methods for CVE-2026-82920

Indicators of Compromise

PUT requests to /api/v4/access_control_policies submitted by non-system administrator accounts.
Access control policy audit records showing unexpected detachment of system-assigned parent policies.
Requests to the access control policy endpoint containing an empty imports array in the JSON body.

Detection Strategies

Enable Mattermost audit logging and alert on all mutations to access control policies performed by users without the system administrator role.
Correlate API access logs with role assignments to identify channel or team administrators invoking policy management endpoints.
Compare current ABAC policy inheritance state against a known-good baseline to detect unauthorized detachment.

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized logging platform for retention and query.
Alert on any HTTP request body to /api/v4/access_control_policies containing "imports": [].
Review ABAC policy configurations on a scheduled cadence to identify drift from the intended enforcement model.

How to Mitigate CVE-2026-82920

Immediate Actions Required

Upgrade Mattermost to a fixed release published in the Mattermost Security Updates advisory for MMSA-2026-00724.
Audit current ABAC policies and re-attach any parent policies that were removed prior to patching.
Review the assignment of channel and team administrator roles and remove unnecessary privilege delegations.

Patch Information

Mattermost has published fixes for the affected branches. Administrators running versions 11.9.0, 11.8.4, 11.7.7, or earlier within those branches must upgrade to the patched releases identified in the vendor advisory MMSA-2026-00724.

Workarounds

Restrict channel and team administrator roles to trusted users until the patch is applied.
Monitor and alert on PUT /api/v4/access_control_policies API activity to detect exploitation attempts.
Periodically reconcile ABAC parent policy assignments against the intended configuration and revert unauthorized changes.

bash

# Example: audit log filter to surface policy update calls
grep -E 'PUT /api/v4/access_control_policies' /opt/mattermost/logs/mattermost.log \
  | grep -v 'role=system_admin'