All Mattermost team administrators can assign any built‑in role to a member through the {{update-team-member-roles}} REST API because the system does not check the configured permission scheme, which allows an administrator to grant a user permissions beyond those that are permitted by the intended design, effectively escalating that user's privileges.

The flaw affects Mattermost server instances running versions 11.7.x up to and including 11.7.10. These products should be upgraded to 11.7.11 or any higher release such as 11.11.0 in order to receive the fix that enforces proper role restrictions.

With a CVSS score of 3.8 the severity is low but the capability to elevate a user’s permissions can be abused by a compromised administrator. Because the exploit requires authenticated API access, the risk is limited to environments where admin credentials have been compromised or misused; the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation at this time.