CVE-2026-8823

Summary

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Mattermost Advisory ID: MMSA-2026-00669

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost11.7.0 <= 11.7.0affected
MattermostMattermost10.11.0 <= 10.11.17affected
MattermostMattermost11.8.0unaffected
MattermostMattermost11.7.1unaffected
MattermostMattermost10.11.18unaffected

Weaknesses

  • CWE-863: CWE-863: Incorrect Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References