Vulnerability Details CVE-2026-8823
Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrade arbitrary bot accounts via the standard demote-user API.. Mattermost Advisory ID: MMSA-2026-00669
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.9%
CVSS Severity
CVSS v3 Score 3.8
References
Products affected by CVE-2026-8823
-
cpe:2.3:a:mattermost:mattermost_server:10.11.0
-
cpe:2.3:a:mattermost:mattermost_server:10.11.1
-
cpe:2.3:a:mattermost:mattermost_server:10.11.10
-
cpe:2.3:a:mattermost:mattermost_server:10.11.11
-
cpe:2.3:a:mattermost:mattermost_server:10.11.12
-
cpe:2.3:a:mattermost:mattermost_server:10.11.13
-
cpe:2.3:a:mattermost:mattermost_server:10.11.14
-
cpe:2.3:a:mattermost:mattermost_server:10.11.15
-
cpe:2.3:a:mattermost:mattermost_server:10.11.16
-
cpe:2.3:a:mattermost:mattermost_server:10.11.17
-
cpe:2.3:a:mattermost:mattermost_server:10.11.2
-
cpe:2.3:a:mattermost:mattermost_server:10.11.3
-
cpe:2.3:a:mattermost:mattermost_server:10.11.4
-
cpe:2.3:a:mattermost:mattermost_server:10.11.5
-
cpe:2.3:a:mattermost:mattermost_server:10.11.6
-
cpe:2.3:a:mattermost:mattermost_server:10.11.7
-
cpe:2.3:a:mattermost:mattermost_server:10.11.8
-
cpe:2.3:a:mattermost:mattermost_server:10.11.9
-
cpe:2.3:a:mattermost:mattermost_server:11.7.0