The vulnerability in Mattermost allows an authenticated user to move from a guest account to a team or channel administrator by sending a specially crafted PUT request to the member roles API. Because the server fails to validate the combination of guest and admin scheme roles, the request bypasses normal authorization checks, effectively granting elevated privileges. This flaw is a classic example of missing authorization logic, identified by CWE‑863.

Affected products include Mattermost Mattermost. Vulnerable releases are versions 11.10.x up to and including 11.10.0, 11.7.x up to 11.7.9, 11.9.x up to 11.9.1, and 11.8.x up to 11.8.5.

The CVSS base score of 6.5 indicates a medium severity flaw. The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session and the ability to send a PUT request to the member roles endpoint, which is typically restricted to administrators. The attacker can achieve full administrative rights on the target team or channel, compromising confidentiality, integrity, and availability for all members of that scope.