First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-8074

LowCVSS 3.8/10Last modified Jun 23, 2026

Description

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to enforce bot-specific permission checks on the user active status endpoint, which allows a User Manager with user management write access but no Integrations access to deactivate bot accounts via the PUT /api/v4/users/{id}/active API endpoint.. Mattermost Advisory ID: MMSA-2026-00667

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
Mattermost	Mattermost	>= 11.7.0, <= 11.7.0; >= 10.11.0, <= 10.11.17

References

https://mattermost.com/security-updatesVendor Advisory

Timeline

Published: Jun 22, 2026
Last modified: Jun 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-80740In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix infinite loop when scale is too large for display When sc CVE-2026-807417.1In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_k CVE-2026-80742In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reported CVE-2026-80743In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers The irq CVE-2026-80744In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort CVE-2026-807458.4In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEG_ta CVE-2026-80746In the Linux kernel, the following vulnerability has been resolved: clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliz CVE-2026-807478.0In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser v CVE-2026-807487.8In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500 CVE-2026-807497.1In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function wa CVE-2026-80756.5Mattermost Desktop App versions <=6.2 5.5.13 6.0.2.0 fail to properly null check when checking for headers in the Mattermost Desktop App whi CVE-2026-807508.4In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_

CVE-2026-8074: Low severity, CVSS 3.8 | Vulnix