CVE-2026-8821: Mattermost Auth Bypass Vulnerability

CVE-2026-8821 Overview

CVE-2026-8821 is a missing authorization vulnerability [CWE-862] in Mattermost. The flaw resides in the playbook run creation workflow, which fails to validate channel member-management permissions. An authenticated channel member can add an arbitrary user to a restricted channel by supplying that user in the run owner field. The issue is tracked under Mattermost Advisory ID MMSA-2026-00677.

The vulnerability affects multiple release branches and enables horizontal privilege escalation within channel membership boundaries. Attackers exploit it over the network with low privileges and no user interaction.

Critical Impact
Any authenticated channel member can bypass channel access controls and expose confidential channel content to unauthorized users through the playbook run owner field.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4
Mattermost 11.7.x versions <= 11.7.7 and 10.11.x versions <= 10.11.22

Discovery Timeline

2026-09-14 - CVE-2026-8821 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-8821

Vulnerability Analysis

Mattermost's Playbooks feature lets users orchestrate incident response workflows tied to channels. When a user initiates a playbook run, the API accepts a run owner parameter that identifies the responsible user. The server assigns that user to the associated channel to guarantee the owner can act on the run.

The defect lies in this side effect. The endpoint enforces that the caller is a channel member but does not verify the caller has permission to manage channel membership. As a result, a low-privileged member can name any Mattermost user as the run owner and force that user into a restricted channel.

The outcome is a broken access control condition that undermines channel confidentiality. Private channel content, files, and message history become visible to users who were never granted access through the normal invitation flow.

Root Cause

The root cause is a missing authorization check [CWE-862] in the playbook run creation handler. The code path treats channel membership as sufficient authority to add other users, conflating the ability to create a run with the ability to modify channel membership. Channel administrators or explicit manage_members permission holders should be the only actors permitted to add users to a private or restricted channel.

Attack Vector

An authenticated user with membership in a target channel issues a playbook run creation request to the Mattermost API. The request specifies the owner_user_id field with the identifier of a user who is not a member of the channel. The server creates the run and adds the specified user to the channel without validating the caller's membership-management privileges. The added user immediately gains read access to all channel content. See the Mattermost Security Updates advisory for full technical details.

Detection Methods for CVE-2026-8821

Indicators of Compromise

Unexpected channel membership changes correlated with playbook run creation events in the Mattermost audit log.
Playbook runs where the owner_user_id differs from the calling user and the owner was not previously a channel member.
User accounts appearing in private channels without a corresponding add_to_channel action by a channel admin.

Detection Strategies

Query Mattermost audit logs for playbook_run.create events and join against channel membership changes occurring within the same transaction window.
Alert on any playbook run creation where the run owner is not the request initiator and the owner was added to the channel in the same event chain.
Baseline normal playbook usage per team, then flag deviations such as runs created by users who rarely trigger playbooks.

Monitoring Recommendations

Forward Mattermost application logs and audit events to a centralized logging platform for correlation across users, channels, and playbook activity.
Review privileged channel membership on a scheduled cadence and reconcile against expected access lists.
Enable and monitor Mattermost's compliance export features to retain playbook and channel activity for forensic review.

How to Mitigate CVE-2026-8821

Immediate Actions Required

Upgrade Mattermost to a fixed release: 11.9.1 or later, 11.8.5 or later, 11.7.8 or later, or 10.11.23 or later.
Audit membership of sensitive and restricted channels for users added since the earliest affected release deployed in your environment.
Review recent playbook run creation events and remove unauthorized users from channels where the run owner field was abused.

Patch Information

Mattermost has published fixed versions across the affected branches. Refer to the Mattermost Security Updates page for advisory MMSA-2026-00677 and the corresponding release notes. Apply the appropriate patched version for your deployment branch and restart the Mattermost server after upgrading.

Workarounds

Disable the Playbooks plugin in the Mattermost System Console until the server can be upgraded.
Restrict playbook creation and execution to trusted users through role-based permissions in the System Console.
Move highly sensitive discussions to channels that are not associated with any playbook while remediation is pending.

bash

# Example: disable the Playbooks plugin via mmctl
mmctl plugin disable playbooks

# Verify plugin status
mmctl plugin list