CVE-2026-9816: Mattermost Server Auth Bypass Vulnerability

CVE-2026-9816 Overview

CVE-2026-9816 affects Mattermost Server versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3. The server fails to validate BoardMember.Scheme* fields on insert and archive-import paths. A board editor or non-guest team member can assign board administrator privileges to arbitrary users. Exploitation occurs through POST /api/v2/boards/{boardID}/members or POST /api/v2/teams/{teamID}/archive/import. Mattermost tracks the issue as advisory MMSA-2026-00685 and categorizes it under CWE-863: Incorrect Authorization.

Critical Impact
Low-privileged authenticated users can escalate to board administrator, compromising board integrity and availability across affected Mattermost workspaces.

Affected Products

Mattermost Server 11.7.x up to and including 11.7.6
Mattermost Server 10.11.x up to and including 10.11.21
Mattermost Server 11.8.x up to and including 11.8.3

Discovery Timeline

2026-08-17 - CVE-2026-9816 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-9816

Vulnerability Analysis

The flaw resides in the Mattermost Boards authorization layer. Server-side handlers accept BoardMember objects from clients without validating the Scheme* permission fields. These fields include SchemeAdmin, SchemeEditor, SchemeCommenter, and SchemeViewer, which determine a member's role on a board.

When a client submits a request to add or import members, the server persists these permission fields directly to the database. The application trusts client-supplied role assignments instead of enforcing server-side authorization checks tied to the caller's actual privileges.

An authenticated board editor or non-guest team member can therefore promote themselves or any other user to board administrator. This bypasses the intended role-based access control model for Mattermost Boards.

Root Cause

The root cause is missing authorization enforcement on write paths that process BoardMember structures. The insert handler for /api/v2/boards/{boardID}/members and the archive import handler for /api/v2/teams/{teamID}/archive/import both deserialize member records without stripping or verifying elevated scheme flags against the requester's role. This is a classic CWE-863 incorrect authorization pattern.

Attack Vector

An attacker authenticates to the Mattermost workspace as a low-privileged user with edit access to a board or membership in a team. They issue a crafted POST request to the board members endpoint with SchemeAdmin set to true in the JSON payload. Alternatively, they upload a malicious team archive containing board member records with elevated scheme fields through the archive import endpoint. The server accepts the payload and grants board administrator rights, allowing the attacker to modify board contents, remove other administrators, or delete the board.

No verified public exploit code is available. Refer to the Mattermost Security Updates advisory for additional technical context.

Detection Methods for CVE-2026-9816

Indicators of Compromise

Unexpected board administrator role assignments in the focalboard_board_members table where scheme_admin transitions from false to true outside normal admin workflows.
HTTP requests to POST /api/v2/boards/{boardID}/members originating from users without existing board administrator rights.
Successful calls to POST /api/v2/teams/{teamID}/archive/import followed by unexpected privilege changes on imported boards.

Detection Strategies

Review Mattermost audit logs for boards.addMember and boards.archiveImport events and correlate the initiating user's team role against the resulting scheme changes.
Flag any API payload to Boards member endpoints where schemeAdmin, schemeEditor, or schemeCommenter is set by a non-admin caller.
Baseline archive import activity per team and alert on imports that create board memberships with administrator flags.

Monitoring Recommendations

Forward Mattermost server access logs and audit events into a centralized logging platform for retention and correlation.
Monitor role change frequency per board and alert on spikes indicating bulk privilege modification.
Track authentication events for accounts that recently gained board administrator status and review their subsequent actions.

How to Mitigate CVE-2026-9816

Immediate Actions Required

Upgrade Mattermost Server to version 11.7.7, 10.11.22, 11.8.4, or later as published in the Mattermost Security Updates advisory.
Audit current board membership tables for unauthorized scheme_admin assignments and revoke unexpected privileges.
Rotate API tokens and session keys for any user identified as having exploited the flaw.

Patch Information

Mattermost has released fixed versions addressing advisory MMSA-2026-00685. Administrators should apply the vendor patches referenced on the Mattermost Security Updates page. The fix adds server-side validation of BoardMember.Scheme* fields on both the members insert path and the team archive import path.

Workarounds

Restrict access to Boards by disabling the Boards plugin for untrusted teams until the server is patched.
Limit team archive import capability to trusted system administrators through role and permission scheme configuration.
Convert non-essential team members to guest accounts, since guests are not eligible to trigger the vulnerable code paths.

bash

# Verify installed Mattermost Server version
mattermost version

# Example: disable Boards plugin via mmctl until patched
mmctl plugin disable focalboard