Technical impact
In affected Mattermost releases, when an administrator demotes a user to a guest role, the system fails to verify whether the target is a bot account. This flaw allows an administrator lacking explicit bot‑management rights to lower the privileges of any bot, effectively stripping it of its core permissions and disrupting automated workflows. This weakness is classified as CWE‑863: Authorization Bypass Through Legitimate Credentials.
Affected Systems
Versions 11.7.0 or earlier and 10.11.17 or earlier of Mattermost are vulnerable. Versions 11.8.0, 11.7.1, and 10.11.18 or later contain the fix and are not affected.
Risk and Exploitability
The CVSS score of 3.8 marks the issue as low severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Attackers would need to invoke the standard demote‑user API while authenticated as an administrator, so the vector is an internal, authenticated API call. Because the impact is limited to privilege degradation of bot accounts, the overall risk to organizational security is minimal.
Github GHSA