Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 fail to require a system‑level permission when patching protected default system roles. The missing check allows authenticated users who possess delegated user‑management permissions to use the role patch API to alter built‑in role permissions, effectively elevating their privileges within the system.

The vulnerability affects Mattermost and applies to the following product releases: 11.6.0 through 11.6.1, 11.5.0 through 11.5.4, and 10.11.0 through 10.11.16. Updating to any version 11.7.0, 11.6.2, 11.5.5, 10.11.16, 10.11.17 or later removes the flaw.

The CVSS score of 6.7 indicates a medium‑high severity threat. Exploitation requires an authenticated user with delegated user‑management rights; the attacker can immediately invoke the role patch API to modify protected roles. EPSS data is not available, but the existence of a public advisory suggests the flaw is likely to be exploited. The vulnerability is not currently listed as a known exploited vulnerability (KEV).