CVE-2026-82920

Executive Summary

CVE-2026-82920 is an authorization boundary enforcement failure (CWE-863) in Mattermost server versions 11.7.x (<=11.7.7), 11.8.x (<=11.8.4), and 11.9.x (<=11.9.0). A channel or team administrator can detach a system-assigned Attribute-Based Access Control (ABAC) parent policy by sending a crafted PUT /api/v4/access_control_policies request that supplies an empty imports list, thereby weakening enforced access-control inheritance. The impact is a confidentiality and integrity concern scoped beyond the vulnerable component (CVSS 5.5, S:C), enabling a lower-privileged team/channel admin to alter org-wide access-control posture that should have been immutable at their privilege level.

Technical Analysis

The vulnerability is classified as CWE-863: Incorrect Authorization. Mattermost implements ABAC via a policy object model in which system-assigned "parent" policies are intended to be inherited by subordinate (channel/team) policies. The affected endpoint is PUT /api/v4/access_control_policies, which handles update operations on access control policy objects.

The core flaw: the endpoint fails to enforce authorization boundaries on policy updates. Specifically, the request body's imports field is accepted from a channel or team administrator, and when that imports list is empty, the system-assigned ABAC parent policy association is detached. The server does not validate that the caller holds sufficient privilege (e.g., system administrator) to modify a system-assigned policy or to remove its parent linkage. The result is that a role explicitly intended to manage only its channel/team scope can mutate policy inheritance that is global/system-assigned.

Why this matters technically:

1. Trust boundary inversion — The parent policy is system-assigned, meaning the platform operator intended it as a non-negotiable baseline. The update endpoint honors a lower-privileged actor's request as if it were privileged, inverting the intended trust boundary.
2. Scope change (S:C) — Because detaching the parent removes inherited constraints, the security scope of the impact extends beyond the vulnerable component itself (other channels/teams relying on inherited policy), which is why the CVSS vector marks S:C.
3. Partial CIA impact (C:L/I:L) — The principal consequence is weakened authorization enforcement leading to potential unauthorized read (confidentiality) and unauthorized modification (integrity) of content that the parent policy was designed to protect. Availability is unaffected (A:N).
4. Attack prerequisites — PR:H reflects that the attacker needs a privileged account, but only at the channel/team administrator level, not system administrator. AV:N/AC:L/UI:N indicate this is remotely reachable, low-complexity, and requires no user interaction.

No public proof-of-concept code, exploit code, or Nuclei template is associated with this CVE. EPSS is 0.00152 (4.8th percentile), indicating low modeled near-term exploitation likelihood. No CISA KEV listing. No vendor fix evidence was identified across tracked sources as of this report.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description and associated advisory. No public PoC is available; the chain is inferred at the vulnerability-class level (authorization bypass on a policy-update API).

1. Reconnaissance / target identification

   • Identify a reachable Mattermost deployment running an affected version: 11.7.x <= 11.7.7, 11.8.x <= 11.8.4, or 11.9.x <= 11.9.0.
   • Confirm the target uses ABAC with system-assigned parent policies (ABAC feature deployments).
   • Obtain or already possess valid credentials for a channel administrator or team administrator role — the minimum privilege required by PR:H.

2. Triggering the flaw class (incorrect authorization on policy update)

   • Authenticate as the channel/team administrator.
   • Issue an authorized-looking request to the access control policy update endpoint: PUT /api/v4/access_control_policies.
   • The request targets a policy object and includes an imports field set to an empty list. The server does not verify that the caller may modify system-assigned policy inheritance, so the update is processed.

3. Payload/execution method (vulnerability-class level)

   • The mechanism is not code injection or memory corruption; it is a logic/authorization bypass. The "payload" is a well-formed API request body whose imports list is empty, causing the parent policy linkage to be dropped.
   • No special encoding or exploit primitive is required beyond legitimate API access with the required role.

4. Post-exploitation impact

   • The system-assigned ABAC parent policy is detached from the target policy, so the inherited constraints it enforced no longer apply to affected channels/teams.
   • With authorization constraints weakened, the attacker (or other users operating under the now-ungated policy) may gain broader access than intended — enabling unauthorized read (C:L) and modification (I:L) of content that the parent policy was designed to protect.
   • Because the impact scope crosses the vulnerable component boundary (S:C), the effective blast radius can extend to all policy consumers inheriting from the detached parent. The consequence is a degradation of the organization's access-control baseline rather than direct RCE or data exfiltration by the CVE mechanism itself.

No public exploit code, Metasploit module, or Nuclei template is known for this CVE. Attackers with an existing team/channel admin foothold could weaponize this manually; no automated tooling is documented.

Impact Assessment

• Business impact: Weakened enforcement of organization-wide access-control policy. ABAC parent policies typically encode compliance, segregation-of-duties, or data-classification requirements. Detaching them can silently violate those controls, exposing regulated or sensitive channel/team content and permitting unauthorized edits. This is a governance and compliance risk as much as a technical one.
• Affected systems: Mattermost server deployments on 11.7.x (<=11.7.7), 11.8.x (<=11.8.4), and 11.9.x (<=11.9.0) that use ABAC with system-assigned parent policies.
• Blast radius and CVSS subscores:
  • AV:N — exploitable over the network via the web API.
  • AC:L — no special conditions or race required.
  • PR:H — requires a channel/team administrator account; this constrains who can launch the attack but assumes an insider or compromised privileged account.
  • UI:N — no victim interaction needed.
  • S:C — the security impact scope changes; effects can propagate beyond the directly vulnerable component to other policy-inheriting channels/teams.
  • C:L / I:L — limited confidentiality and integrity impact; no availability impact (A:N).
  • Aggregate score: 5.5 (Medium).
• Threat landscape: EPSS 0.00152 (~4.8th percentile) and no CISA KEV listing indicate low observed exploitation pressure. No named threat-actor campaigns or in-the-wild exploitation evidence were identified. The realistic threat vector is a malicious or compromised insider holding a team/channel admin role.

Detection Guidance

Sigma Rule

title: Mattermost ABAC Parent Policy Detach via Empty Imports List
id: 9f1a7c2e-3b4d-4e88-9a10-6c02f5ab7d31
status: experimental
description: Detects a channel/team administrator detaching a system-assigned ABAC parent policy by updating access_control_policies with an empty imports list (CVE-2026-82920).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82920
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
  product: mattermost
  service: audit
detection:
  selection_endpoint:
    event_type: 'api_access'
    api_path|contains: '/api/v4/access_control_policies'
    http_method: 'PUT'
  selection_payload:
    request_body|contains: '"imports"'
    request_body|contains: '"imports":[]'
  condition: selection_endpoint and selection_payload
fields:
  - user_id
  - user_role
  - api_path
  - http_method
  - request_body
  - source_ip
falsepositives:
  - Legitimate system administrators intentionally reconfiguring policy imports
  - Automated policy management tooling
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1190
  - cve.2026-82920

YARA Rule

rule CVE_2026_82920_Mattermost_ABAC_Policy_Detach
{
    meta:
        description = "Detects HTTP request artifacts attempting to detach a system-assigned ABAC parent policy via an empty imports list (CVE-2026-82920)"
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82920"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $endpoint = "/api/v4/access_control_policies" ascii nocase wide
        $method   = "PUT" ascii wide
        $imports1 = "\"imports\"" ascii nocase
        $imports2 = "\"imports\":[]" ascii nocase
        $imports3 = "\"imports\": []" ascii nocase
        $abac     = "access_control" ascii nocase wide

    condition:
        $endpoint and $abac and ($imports1 or $imports2 or $imports3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82920 Mattermost ABAC Parent Policy Detach Attempt (empty imports list)"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/api/v4/access_control_policies"; http.request_body; content:"\"imports\""; http.request_body; content:"[]"; reference:cve,2026-82920; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82920; classtype:attempted-admin; sid:2026829201; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5s
  [http where http.request.method == "PUT"
     and url.path : "/api/v4/access_control_policies"
     and http.request.body.text : "\"imports\""]
  [http where http.request.method == "PUT"
     and url.path : "/api/v4/access_control_policies"
     and http.request.body.text : "[]"]

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit OR sourcetype=nginx:access
| eval api_path=coalesce(api_path, uri_path, url)
| eval http_body=coalesce(request_body, request, body)
| where (match(api_path, "/api/v4/access_control_policies") AND match(http_body, "\"imports\""))
| rex field=http_body max_match=0 "\"imports\"\s*:\s*\[(?<imports_val>[^\]]*)\]"
| where imports_val="" OR isnull(imports_val)
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users values(user_role) as roles by src_ip, api_path
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-82920,">
  <rule id="2026829" level="8">
    <decoded_as>json</decoded_as>
    <field name="method">^PUT$</field>
    <field name="path" type="pcre2">/api/v4/access_control_policies</field>
    <field name="body" type="pcre2">"imports"\s*:\s*\[\s*\]</field>
    <description>CVE-2026-82920: Mattermost channel/team admin attempted to detach system-assigned ABAC parent policy via empty imports list</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control_policy,hpm,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (until a vendor fix is available):

   • Detect and alert on all PUT /api/v4/access_control_policies requests containing "imports":[] or an empty imports list (see detection rules above).
   • Restrict channel/team administrator privileges to the minimum necessary set and audit who holds these roles.
   • Where possible, place a reverse-proxy/WAF rule in front of Mattermost to reject requests to /api/v4/access_control_policies that remove imports from system-assigned policies, or block such updates from non–system-admin sessions.
   • Review and snapshot current ABAC policy state (including parent/child inheritance) to establish a known-good baseline; monitor for unexpected parent-policy detachments.
   • Enable and centralize Mattermost audit logging, and alert on the detection signatures provided.
   • Evaluate whether ABAC with system-assigned parent policies is actually required for current operations; if not, its use can be reduced to shrink exposure.

2. Patch / upgrade steps:

   • No fixed version is confirmed in tracked sources. Monitor the Mattermost security advisories page for MMSA-2026-00724 for the official fixed-version release.
   • Once a fix is published, upgrade all affected servers: 11.7.x (<=11.7.7), 11.8.x (<=11.8.4), and 11.9.x (<=11.9.0) to the vendor-recommended fixed release.
   • After upgrading, re-validate that system-assigned ABAC parent policies are honored and cannot be detached by channel/team administrators.

3. Long-term hardening:

   • Enforce least privilege on team/channel administrator roles; require explicit system-administrator authority for any operation touching system-assigned policy objects.
   • Adopt defense-in-depth: server-side authorization checks that validate caller privilege against the policy object's scope (system vs. team vs. channel).
   • Implement continuous configuration monitoring for ABAC policy inheritance, with automatic alerting on parent-policy changes.
   • Maintain a vulnerability management cadence that tracks Mattermost advisories and MMSA IDs; treat authorization-logic flaws as high priority in access-controlled collaboration platforms.

References

• NVD — CVE-2026-82920: https://nvd.nist.gov/vuln/detail/CVE-2026-82920
• Mattermost Security Advisories — MMSA-2026-00724: https://mattermost.com/security-updates/
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• FIRST EPSS — CVE-2026-82920 (score 0.00152, 4.8th percentile): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-82920 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild note: No CISA KEV listing, no public PoC, no Nuclei template, and no named threat-actor campaign were identified for CVE-2026-82920 as of this report. EPSS (0.00152) indicates low predicted exploitation activity; the realistic risk is insider or compromised team/channel administrator abuse.