Skip to content
CVE PROGRAM SOURCE RECORD3.8 Low

CVE-2026-8074

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 11.7.0 to ≤ 11.7.0affected
  • 10.11.0 to ≤ 10.11.17affected
  • 11.8.0unaffected
  • 11.7.1unaffected
  • 10.11.18unaffected

References