{"id":"EUVD-2026-38248","enisaUuid":"172502d0-5b6a-3fe8-b3c4-8fa012a7123c","description":"Mattermost versions 11.7.x \u003c\u003d 11.7.0, 10.11.x \u003c\u003d 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667","datePublished":"Jun 22, 2026, 1:37:44 PM","dateUpdated":"Jun 22, 2026, 3:40:37 PM","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","references":"https://mattermost.com/security-updates\n","aliases":"CVE-2026-8074\nGHSA-g5vr-6pgg-74qv\n","assigner":"Mattermost","epss":0.32,"enisaIdProduct":[{"id":"4339f3bc-0fe5-3f24-bac4-2629d3e8dd2a","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.17"},{"id":"e42b5b09-2cb6-37ed-8b4b-2c8702d953f1","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.7.0 ≤11.7.0"}],"enisaIdVendor":[{"id":"936f29fc-dc33-3862-a332-4053da16d9c3","vendor":{"name":"Mattermost"}}],"enisaIdVulnerability":[{"id":"387e5542-eb1a-3eb4-8c1f-a6d7eec472b8","vulnerability":{"id":"GHSA-g5vr-6pgg-74qv","description":"Mattermost doesn\u0027t enforce bot-specific permission checks on the user active status endpoint","datePublished":"Jun 22, 2026, 3:30:46 PM","dateUpdated":"Sep 15, 2026, 7:51:20 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-8074\nhttps://github.com/mattermost/mattermost\nhttps://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-38248\n","aliases":"GHSA-g5vr-6pgg-74qv\nCVE-2026-8074\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b39a0dd3-adb9-3698-bb2b-fe6539e64b18","vulnerability":{"id":"CVE-2026-8074","description":"Mattermost versions 11.7.x \u003c\u003d 11.7.0, 10.11.x \u003c\u003d 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667","datePublished":"Jun 22, 2026, 1:37:44 PM","dateUpdated":"Jun 22, 2026, 3:40:37 PM","status":"PUBLISHED","baseScore":3.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","references":"https://mattermost.com/security-updates\n","enisa_id":"EUVD-2026-38248\n","assigner":"Mattermost","epss":0.32,"dataProcessed":"Nov 3, 2026, 7:18:02 AM","vulnerabilityProduct":[{"id":"85ee5548-f55e-37f4-b6e1-f764224d02ff","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"10.11.0 ≤10.11.17"},{"id":"f20c6951-80b0-3eb9-9159-8ebd2284291d","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}},"product_version":"11.7.0 ≤11.7.0"}],"vulnerabilityVendor":[{"id":"9110e91d-1bb3-38f6-bff0-96d2cf2b91f2","vendor":{"name":"Mattermost"}}]}}],"enisaIdAdvisory":[{"id":"ce89b2d4-fdd4-3750-ac10-83dcc32998f7","advisory":{"id":"WID-SEC-W-2026-1650","description":"Mattermost (Desktop, Server und Mobile): Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Mattermost ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen und um Informationen offenzulegen.","datePublished":"May 21, 2026, 10:00:00 PM","dateUpdated":"Jun 22, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1650.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-1650\n","aliases":"CVE-2026-5139\nCVE-2026-6062\nCVE-2026-6673\nCVE-2026-8074\nCVE-2026-9162\nCVE-2026-22880\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"045ff5e9-3f1d-3c92-8cd0-565c8159f629","product":{"name":"Mobile 11.2.4","vendor":{"name":"Mattermost"}}},{"id":"1d71fd2c-c928-344b-8a5d-ccb1d54a6f55","product":{"name":"Mobile 11.4.1","vendor":{"name":"Mattermost"}}},{"id":"2bfc9749-c058-34de-bf77-5b9cc0c05a47","product":{"name":"Desktop 5.13.6","vendor":{"name":"Mattermost"}}},{"id":"30688ff1-384e-3c71-a1d5-fa5c2cb4cf86","product":{"name":"Server 10.11.18","vendor":{"name":"Mattermost"}}},{"id":"37bbab54-c644-3aa3-9744-26d6cb6c96c0","product":{"name":"Server 11.8.0","vendor":{"name":"Mattermost"}}},{"id":"4416cb31-70cc-3d15-a124-c0513d362f0b","product":{"name":"Server 11.5.6","vendor":{"name":"Mattermost"}}},{"id":"454a0923-72d1-37f0-b403-f4dd704db903","product":{"name":"Mobile 11.3.2","vendor":{"name":"Mattermost"}}},{"id":"676261fa-2829-3ca3-9f41-cafb82d413e0","product":{"name":"Desktop 6.2","vendor":{"name":"Mattermost"}}},{"id":"a54bfb9b-aa46-3312-bc74-fb9147b36916","product":{"name":"Server 11.7.1","vendor":{"name":"Mattermost"}}},{"id":"aa5885e2-904e-37ae-a5dd-72c6df3a70e4","product":{"name":"Mattermost","vendor":{"name":"Mattermost"}}},{"id":"af2891e9-a84c-33ec-9805-ee41d0a9685e","product":{"name":"Server 11.6.3","vendor":{"name":"Mattermost"}}},{"id":"e867a6ad-9099-3c9e-ad3b-e00fd460c213","product":{"name":"Mobile 11.5","vendor":{"name":"Mattermost"}}},{"id":"ea9213c9-883c-3b43-9edc-853cb0356bef","product":{"name":"Mobile 2.38","vendor":{"name":"Mattermost"}}},{"id":"eb5afb78-2ac2-369f-8423-2a533cea8dd8","product":{"name":"Mobile 10.11.12","vendor":{"name":"Mattermost"}}},{"id":"fa3ed92f-2e97-3eb6-af5d-98a9b4d900bf","product":{"name":"Mobile 2.37.1","vendor":{"name":"Mattermost"}}}]}}]}