CVE-2026-9816: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2026-9816 is a privilege escalation vulnerability in Mattermost Server caused by missing server-side validation of BoardMember.Scheme* fields during board member insertion and archive-import operations. It affects Mattermost versions 11.7.0–11.7.6, 10.11.0–10.11.21, and 11.8.0–11.8.3. The flaw allows a board editor or non-guest team member to grant board admin privileges to arbitrary users via the POST /api/v2/boards/{boardID}/members or POST /api/v2/teams/{teamID}/archive/import endpoints. It carries a CVSS v3.1 base score of 8.3 (High) and is tracked under Mattermost Advisory ID MMSA-2026-00685 (GitHub Advisory, Mattermost Security).

The root cause is CWE-863 (Incorrect Authorization): Mattermost fails to enforce server-side validation of the BoardMember.Scheme* fields when processing requests to add board members or import board archives. Because these fields are accepted from client-supplied input without proper authorization checks, a low-privileged authenticated user (board editor or non-guest team member) can craft API requests that set arbitrary scheme values — effectively elevating any user to board admin. The vulnerable endpoints are POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import (GitHub Advisory, Mattermost Security).

Successful exploitation allows a low-privileged authenticated user to escalate privileges within Mattermost Boards, granting board admin rights to themselves or arbitrary users. This results in high integrity and availability impact — a compromised board admin can modify, delete, or lock board content and manage all board members — along with low confidentiality impact through unauthorized access to board data. The scope is limited to the Mattermost Boards component, but privilege escalation could enable further unauthorized actions across all boards within the affected team (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.245% (16th percentile), indicating a low near-term exploitation probability. Exploitation requires a valid authenticated session with at least board editor or non-guest team member privileges, reducing the attack surface compared to unauthenticated vulnerabilities (GitHub Advisory).

1. Authenticate: Log in to a vulnerable Mattermost instance (versions 11.7.0–11.7.6, 10.11.0–10.11.21, or 11.8.0–11.8.3) with any account that has at least board editor or non-guest team member privileges.
2. Identify target board: Enumerate accessible boards to identify the boardID of the target board using the Mattermost Boards API.
3. Craft malicious request: Construct a POST /api/v2/boards/{boardID}/members request with a JSON body that includes a BoardMember object where Scheme* fields (e.g., schemeAdmin: true) are set to grant admin-level permissions, bypassing the expected role restrictions.
4. Submit request: Send the crafted API request with a valid session token. Because the server does not validate the Scheme* fields, the request is accepted and the target user is granted board admin privileges.
5. Alternative via archive import: Alternatively, craft a malicious board archive file with elevated Scheme* field values and submit it via POST /api/v2/teams/{teamID}/archive/import to achieve the same privilege escalation effect (GitHub Advisory, Mattermost Security).

• Network: Unexpected POST requests to /api/v2/boards/{boardID}/members or /api/v2/teams/{teamID}/archive/import from accounts that are not board admins, particularly with schemeAdmin: true or elevated Scheme* field values in the request body.
• Logs: Mattermost server logs showing board member role changes (especially to admin) initiated by non-admin users; audit log entries reflecting privilege escalation events on board membership endpoints.
• Application Behavior: Sudden appearance of new board admins who were not previously assigned that role; unexpected archive imports resulting in elevated board permissions for existing or new users.

Mattermost has released patched versions that enforce server-side validation of BoardMember.Scheme* fields. Users should upgrade to 10.11.22, 11.7.7, 11.8.4, or 11.9.0 (or later) as soon as possible (Mattermost Security, GitHub Advisory). As an interim measure, administrators should audit existing board member permissions and review recent archive imports for unauthorized privilege escalations. Restricting board editor access to trusted users can reduce the attack surface until patching is complete.

The Canadian Centre for Cyber Security (CCCS) published a security advisory (AV26-828) referencing this vulnerability (CCCS Advisory). The vulnerability was noted in automated CVE tracking feeds including VulDB and Bluesky CVE notification accounts shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability database aggregation.