CVE-2026-8074: Mattermost Bot Deactivation Permission Bypass

Technical summary

CVE-2026-8074 is a permission check bypass (CWE-863) in Mattermost Server's user status endpoint. The PUT /api/v4/users/{id}/active endpoint fails to validate whether the requesting user has sufficient privilege to deactivate bot accounts. The vulnerability allows a User Manager with user management write permissions to modify the active status of bot accounts despite lacking Integrations access, which should be a prerequisite for bot lifecycle operations. This represents a horizontal privilege escalation where role boundaries are not properly enforced at the API layer.

Business impact

Bot deactivation by unauthorized users disrupts automation workflows, integration-driven processes, and monitoring systems that rely on bot continuity. Depending on deployment architecture, an attacker with User Manager privileges could systematically disable critical bots supporting customer communications, data pipelines, or compliance workflows. The impact is availability-focused but can also affect data integrity if the bot's intended function is to enforce guardrails or log interactions. Organizations should audit recent bot deactivation events and review User Manager role assignments.

Affected systems

Mattermost Server versions 11.7.0 and below in the 11.7.x line, and 10.11.17 and below in the 10.11.x line. Verify your deployment version via the System Console or CLI. Organizations running version 11.7.1 or later in the 11.7.x branch, or 10.11.18 or later in the 10.11.x branch, are not affected. Long-term support (LTS) users should confirm their maintenance status with Mattermost to determine if a patch is available for their branch.

Exploitability

Exploitability is straightforward for a User Manager with legitimate console access. No network interaction barriers exist; the attack is a simple API call with a valid authentication token. The attacker must already possess User Manager privileges, which is a high bar but not uncommon in mid-to-large Mattermost deployments with role-based access control in use. The CVSS score of 3.8 (LOW) reflects the high privilege requirement (PR:H) and limited scope of impact (no confidentiality breach, indirect integrity and availability impact). The vulnerability is not known to be exploited in the wild (KEV status: Not listed).

Remediation

Upgrade to a patched version immediately. For the 11.7.x branch, upgrade to 11.7.1 or later. For the 10.11.x branch, upgrade to 10.11.18 or later. Verify patch availability for other maintained branches (e.g., 12.0.x, 11.0.x) via the official Mattermost security advisory MMSA-2026-00667. If immediate patching is not feasible, restrict User Manager role assignments to trusted administrators and audit the permission matrix to ensure bot management operations require explicit Integrations access.

Patch guidance

Mattermost has released patches addressing this issue across affected branches. Consult the official advisory (MMSA-2026-00667) to confirm the exact patch version for your branch. Test patches in a staging environment, particularly if you have custom bots or integrations relying on active status transitions. Patching does not require database migrations or configuration changes; a standard in-place upgrade should suffice.

Detection guidance

Monitor audit logs for unexpected PUT requests to /api/v4/users/{id}/active endpoints, particularly when initiated by User Manager accounts lacking Integrations permissions. Flag deactivation of high-value or production-critical bots. Use Mattermost's native audit log querying (or SIEM integration if available) to search for bot-related status changes by User Manager roles over the past 6–12 months. Correlate deactivation events with user account records to identify suspicious patterns.

Why prioritize this

Although the CVSS score is low, this vulnerability warrants moderate-priority attention because it affects access control boundaries. In organizations with role-based governance, the ability of a User Manager to circumvent integration access restrictions undermines security controls and audit trails. The patch is available and straightforward to deploy, reducing friction for remediation. Prioritize patching in environments where User Manager roles are broadly assigned or where bots perform critical automation.

Risk score, explained

The CVSS 3.1 score of 3.8 (LOW) reflects: (1) high privilege requirement (PR:H)—only User Manager accounts can exploit this; (2) low attack complexity (AC:L)—a direct API call with no dependencies; (3) network-adjacent (AV:N); (4) no confidentiality impact (C:N); and (5) limited integrity and availability impact (I:L, A:L)—bot deactivation disrupts availability and may affect data workflow integrity, but the blast radius is scoped to bot objects and their dependent processes. The user interaction flag (UI:N) indicates no social engineering is required. The score appropriately signals that while the vulnerability is real and should be patched, it does not pose emergency-level risk to most organizations unless User Manager privileges are widely distributed.

Frequently asked questions