The vulnerability arises because the Group Syncable Link and Patch endpoints in Mattermost fail to enforce role‑management authorization when the scheme_admin flag is set. An authenticated user who has permission to manage group links can craft API requests to set scheme_admin for a group, thereby granting themselves and all members of that group team or channel admin status. This creates a privilege escalation path that grants full administrative control within affected teams or channels. The weakness is identified as CWE‑863, which involves failure to check permissions.

Mattermost versions 10.11.x up to 10.11.15, 10.11.16; 11.5.x up to 11.5.4; and 11.6.x up to 11.6.1 are vulnerable. All vulnerability is confined to the Mattermost product; affected users are those with group‑link permissions on these versions.

The CVSS score of 8.8 classifies this issue as high severity. Exploit probability is not available, but the vulnerability is not listed in CISA KEV. The attack vector is likely via the API: an authenticated user with group‑link permissions must send crafted HTTP requests to set the scheme_admin flag. Therefore, the risk is significant for environments where such permissions are assigned to many users, as a single compromised account could elevate a large number of users to administrative roles.