CVE-2026-8074 - Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Back Back to CVE browser

LOW

Improper Permission Check Allows User Manager to Deactivate Bot Accounts

Published Jun 22, 2026

3.8

LOW

CVSS 3.1

EPSS 0.32%

Description

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

Affected products

Vendor Mattermost Product Mattermost Default
unaffected
Affected
- ≥ 10.11.0, ≤ 10.11.17
- 11.7.0
Unaffected
- 10.11.18
- 11.7.1
- 11.8.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mattermost	Mattermost	unaffected	Affected ≥ 10.11.0, ≤ 10.11.17 11.7.0 Unaffected 10.11.18 11.7.1 11.8.0

github.com/mattermost/mattermost-server

Go

Introduced 10.11.0+incompatible Fixed 10.11.18+incompatible
github.com/mattermost/mattermost-server

Go

Introduced 11.7.0+incompatible Fixed 11.7.1+incompatible

Ecosystem	Package	Introduced	Fixed
Go	github.com/mattermost/mattermost-server	10.11.0+incompatible	10.11.18+incompatible
Go	github.com/mattermost/mattermost-server	11.7.0+incompatible	11.7.1+incompatible

Remediation

Vendor solution

Update Mattermost to versions 11.8.0, 11.7.1, 10.11.18 or higher.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38248
Advisory
https://github.com/advisories/GHSA-g5vr-6pgg-74qv
Advisory
https://mattermost.com/security-updates
vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8074

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38248		Advisory
https://github.com/advisories/GHSA-g5vr-6pgg-74qv		Advisory
https://mattermost.com/security-updates		vendor-advisoryVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8074