Description
Mattermost versions 10.11.x <= 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | 10.11.0 – ≤ 10.11.10 | 11.4.0 |
Advisories 1
- WID-SEC-2026-0422 Mattermost: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 19, 2026
References
- MMSA-2025-00531 vendor-advisory