Mattermost server versions 10.11.x up to 10.11.10 contain a flaw where the team member roles API endpoint does not properly enforce permission checks. This allows a user who holds a team administrator role to issue API calls that demote any team member to the Guest role. The primary impact is a unilateral reduction of a member’s privileges, potentially disrupting collaboration and workflow. The vulnerability is related to CWE-863, reflecting improper authorization control over role assignment.

The affected product is Mattermost Server. Version 10.11.0 through 10.11.10 are impacted. The vendor’s advisory recommends upgrading to 10.11.11 or newer, or to 11.4.0 or newer. No other vendors or product lines are listed in the data.

The CVSS score is 3.8, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation. The issue is not listed in the CISA KEV catalog, implying it has not been observed in high-profile exploitation. Exploitation requires authenticated access with team administrator privileges; an authenticated attacker can simply call the API endpoint with the appropriate parameters to demote a member to Guest. The attack vector is therefore internal by authorized users, and the risk is moderate due to the limited impact of privilege reduction and low external exploitability.