CVE-2026-8823

LowCVSS 3.8/10Last modified Jun 26, 2026

Description

Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Mattermost Advisory ID: MMSA-2026-00669

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2026
Last modified
Jun 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-882307.8Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.CVE-2026-882315.7Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information over a network.CVE-2026-882327.8Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.CVE-2026-882337.8Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.CVE-2026-882349.8Release of invalid pointer or reference in Windows iSCSI allows an unauthorized attacker to execute code over a network.CVE-2026-882357.8Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-882367.5Null pointer dereference in Microsoft QUIC allows an unauthorized attacker to deny service over a network.CVE-2026-882377.0Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.CVE-2026-882387.8Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally.CVE-2026-882397.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-88247.5A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A speciallCVE-2026-882408.0Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network.
CVE-2026-8823: Low severity, CVSS 3.8 | Vulnix