CVE-2026-16047

Mattermost, Inc. has patched vulnerabilities in Mattermost versions 10.11.x, 11.7.x and 11.8.x, including the GitLab plugin up to version 11.8. The vulnerabilities concern multiple aspects of the Mattermost software, including improper validation of WebSocket command fields, incorrect reconciliation of SchemeAdmin flags, and insufficient verification of channel ownership at ABAC policy unassign endpoints. This allows authenticated users to, among other things, cause denial-of-service by crashing plugin processes, retain administrative privileges after demotion, and make unauthorized changes to access control policies and board roles. Additionally, guest users can escalate their privileges to Board Admin via specially crafted board archive files. OAuth applications can revoke tokens and authorizations of other integrations through insufficient restrictions on account management endpoints. It is also possible to modify completed playbook runs due to missing run-state validation. Furthermore, users without sufficient read permissions can link boards to channels, exposing private channel memberships. Channel administrators can escalate their permissions via manipulation of the channel member roles API. The GitLab plugin exhibits a vulnerability allowing bots to inject messages with arbitrary URLs into channels without access rights. Thread membership records are not deleted upon leaving a team, which can grant access to private thread content upon rejoining. Finally, there is a vulnerability in server-side validation of BoardMember.Scheme* fields, allowing privilege escalation by assigning board admin rights to arbitrary users, and a permission check is missing when relinking boards to channels via the batch endpoint.

[![CVE-2026-16047 status](https://www.csirts.com/badge/CVE-2026-16047)](https://www.csirts.com/cve/CVE-2026-16047)