CVE-2026-9816

creationtimestamp| type| source ---|---|--- 2026-08-17 23:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcslyth7u22 2026-08-17 23:55:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/esnynuv6upzdy 2026-08-18 16:15:10+00:00| seen|...

CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate BoardMember.Scheme fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/boardID/members a...