CVE-2026-16044

MediumCVSS 5.4/10Last modified Aug 18, 2026

Description

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.7.0, <= 11.7.6; >= 10.11.0, <= 10.11.21

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Aug 17, 2026
Last modified: Aug 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-160454.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token mana CVE-2026-160464.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook run CVE-2026-160474.3Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before CVE-2026-160486.3Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel member role assignment to channel-scope CVE-2026-160494.3Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API r CVE-2026-16057.5In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with CVE-2026-160519.8The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management inte CVE-2026-160522.3The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker CVE-2026-160538.5Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerabilit CVE-2026-160549.1The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a CVE-2026-160557.5The Contest Gallery WordPress plugin before 30.0.7 does not route its front-end login through the standard WordPress authentication flow, i CVE-2026-160564.3The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any auth