CVE-2026-6739

HighCVSS 7.2/10Last modified Jun 18, 2026

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-in role permissions via the role patch API.. Mattermost Advisory ID: MMSA-2026-00656

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2026
Last modified: Jun 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-673906.5Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-673936.5Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-673949.0A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions CVE-2026-673955.9A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path para CVE-2026-673978.5Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.CVE-2026-673988.2Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9 CVE-2026-673999.3Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.CVE-2026-67406.4The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-674019.9A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component CVE-2026-674029.2An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho CVE-2026-674039.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks CVE-2026-674047.4RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, s