CVE-2026-8821

Executive Summary

CVE-2026-8821 is a missing authorization check (CWE-862) in Mattermost that allows an authenticated channel member to bypass channel member-management permission validation during playbook run creation. Affected deployments include Mattermost 11.9.0 and earlier in the 11.9.x line, 11.8.4 and earlier in 11.8.x, 11.7.7 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x. A low-privileged attacker can add an arbitrary user to a restricted channel via the run owner field, resulting in unauthorized disclosure of restricted channel content and integrity loss on channel membership.

Technical Analysis

The vulnerability is classified as CWE-862: Missing Authorization. According to the NVD description, Mattermost "fail[s] to validate channel member-management permission during playbook run creation." The application exposes a playbook run creation workflow, and within that workflow there is a field identified as the "run owner field." When a playbook run is created, the run owner field is used to associate a user with the run. The flaw is that the code path handling playbook run creation does not verify that the requesting user holds the permission required to manage channel members before that field is processed.

Because the validation is absent, an authenticated channel member — a user who is a member of a channel but not an administrator or channel manager — can supply an arbitrary user in the run owner field. The system then adds that arbitrary user to a restricted channel, effectively granting a user who was not authorized for that restricted channel access to it. This is an authorization bypass, not an authentication bypass and not a memory-safety issue. The attacker must already possess a valid authenticated session and membership in the channel used as the vector for run creation.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N indicates network exploitability, low attack complexity, low privileges required, and no user interaction. Confidentiality impact is High, which aligns with the consequence that a restricted channel's contents become readable by an arbitrary added user. Integrity impact is Low, consistent with the modification of channel membership. Availability impact is None.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The advisory identifier is MMSA-2026-00677. Patch confidence is 0/4, with no patch evidence from any tracked source. As a result, the exact code-level implementation of the playbook run creation handler and the precise parameter name of the run owner field are not provided in the available data. The description uses the term "run owner field," but the underlying API parameter name, endpoint path, and handler function name are not disclosed. Analysts should treat this as an authorization design gap within the playbook run creation feature of Mattermost, where the run owner field is used as the injection point for the unauthorized membership change.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862 missing authorization) and the NVD description.

1. Reconnaissance and target identification. The attacker identifies an internet-facing or internally reachable Mattermost instance, typically by locating the login page or the Mattermost application signature. The attacker registers or obtains a standard account, since the vulnerability requires authentication (PR:L). The attacker then identifies a restricted channel that they are permitted to view or participate in and that uses the playbook feature. They identify a target user who is not currently a member of that restricted channel.

2. Triggering the flaw. The attacker initiates the creation of a playbook run through the normal application workflow. During run creation, the application exposes a run owner field. The attacker supplies the target user's identifier in that field. Because Mattermost fails to validate channel member-management permission during playbook run creation, the authorization check that would normally prevent a non-manager from adding users to a restricted channel is not enforced.

3. Execution method. The action succeeds using the attacker's valid authenticated session at the low-privilege level. No user interaction from the victim is required (UI:N). The added user does not need to take any action and, once added, can be the attacker's alternate account or a cooperating account controlled by the attacker, thereby granting access to the restricted channel.

4. Post-exploitation impact. The arbitrary user is added to the restricted channel. That user can then read messages, files, and other content within the restricted channel, producing the High confidentiality impact reflected in the CVSS score. The membership change also produces a Low integrity impact. Because the change is membership-related, the attacker can use it to persist access to otherwise restricted conversations, exfiltrate sensitive discussion content, or establish a secondary account with visibility into restricted operations. Depending on the added user, this can also bypass the intended segregation of sensitive channels in an organizational deployment.

Impact Assessment

Business impact is centered on loss of confidentiality within restricted Mattermost channels. Enterprises frequently use Mattermost restricted channels for incident response, security operations, legal, HR, and executive communications. An authenticated low-privileged user who can add an arbitrary account to such a channel can expose sensitive conversations, attachments, and operational details to unintended parties. The CVSS vector reports Confidentiality: High, Integrity: Low, and Availability: None.

Affected systems are Mattermost deployments on 10.11.x through 10.11.22, 11.7.x through 11.7.7, 11.8.x through 11.8.4, and 11.9.x through 11.9.0. Blast radius is bounded by the number of restricted channels that use playbook runs and by the number of authenticated users with channel membership. Since exploitation requires a valid account and channel membership, the threat is primarily from insiders, compromised standard accounts, or any tenant with self-registration enabled. The absence of a public PoC lowers the immediate likelihood of mass exploitation; EPSS is 0.00171 (6.8th percentile), and the CVE is not in CISA KEV. However, the missing authorization check is trivially triggered once the field is identified, so the vulnerability would be attractive to a motivated insider or an attacker who already holds a foothold.

Detection Guidance

Sigma Rule

title: Mattermost Unauthorized Channel Member Addition via Playbook Run Owner Field
id: 3f7c9c2e-8a4b-4e6d-9c1a-20268821mm01
status: experimental
description: Detects Mattermost audit events where a playbook run is created and an arbitrary user is added to a channel without member-management permission, consistent with CVE-2026-8821.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-8821
  - https://mattermost.com/security-updates/
author: valtersit.com Threat Intelligence
date: 2026/05/18
tags:
  - attack.t1190
  - cve.2026.8821
logsource:
  product: mattermost
  service: audit
detection:
  selection_event:
    event:
      - playbook_run_created
      - playbook_run_create
  selection_channel:
    channel_type: 'private'
  selection_field:
    run_owner|exists: true
  filter_authorized:
    actor_role:
      - 'system_admin'
      - 'team_admin'
      - 'channel_admin'
  condition: selection_event and selection_channel and selection_field and not filter_authorized
falsepositives:
  - Legitimate channel managers creating playbook runs with valid run owner assignment
level: high

YARA Rule

rule CVE_2026_8821_Mattermost_Playbook_Run_Owner
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects references to Mattermost playbook run creation and run owner field abuse linked to CVE-2026-8821"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-8821"
        date = "2026-05-18"
        cve = "CVE-2026-8821"
        severity = "high"
    strings:
        $a1 = "playbook_run" ascii nocase
        $a2 = "run_owner" ascii nocase
        $a3 = "run owner" ascii nocase nocase
        $b1 = "MMSA-2026-00677" ascii nocase
        $b2 = "CVE-2026-8821" ascii nocase
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        (any of ($a*)) and (any of ($b*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-8821 Mattermost Playbook Run Creation Run Owner Field Abuse"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"playbook"; nocase; http.uri; content:"run"; nocase; http.request_body; content:"run_owner"; nocase; http.request_body; content:"user_id"; nocase; classtype:attempted-user; reference:cve,2026-8821; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-8821; sid:2026882101; rev:1; metadata:created_at 2026_05_18, updated_at 2026_05_18, confidence Medium, impact_scope enterprise;)

Elastic Detection

sequence by user.name with maxspan=5m
  [any where event.action == "playbook_run_create" or event.action == "playbook_run_created"]
  [any where event.action in ("add_channel_member","channel_member_added") and
   not user.roles in ("system_admin","team_admin","channel_admin")]

Splunk SPL Query

index=mattermost sourcetype=mattermost:audit
(event=playbook_run_created OR event=playbook_run_create)
| join type=inner max=1 event_id [ search index=mattermost sourcetype=mattermost:audit
  (event=add_channel_member OR event=channel_member_added)
  NOT actor_role IN ("system_admin","team_admin","channel_admin") ]
| table _time, actor_user, actor_role, target_user, channel_id, channel_type, run_owner
| where channel_type="private"

Wazuh OSSEC Rule

<group name="mattermost,cve-2026-8821,">
  <rule id="20268821" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">playbook_run_create|playbook_run_created</field>
    <description>CVE-2026-8821: Mattermost playbook run created with run owner field by non-manager</description>
    <options>no_full_log</options>
  </rule>
  <rule id="20268822" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">channel_member_added|add_channel_member</field>
    <field name="channel_type">private</field>
    <description>CVE-2026-8821: Unauthorized user added to restricted Mattermost channel</description>
  </rule>
  <rule id="20268823" level="14">
    <if_sid>20268821,20268822</if_sid>
    <field name="actor_role">member|user</field>
    <description>CVE-2026-8821: Missing authorization on Mattermost channel member management (high confidence)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source), and no vendor fix or workarounds are listed in the available data.

1. Immediate mitigations. Restrict self-registration on the Mattermost instance so that only vetted accounts can authenticate. Audit membership of restricted channels and remove any unexpected members. Review playbook run history for run owner assignments that added users to restricted channels without a corresponding authorization record. Consider disabling the playbook feature for non-administrative users until a fix is available, since the flaw is in the playbook run creation path. Harden restricted channels by keeping sensitive discussions in channels with tightly maintained membership lists and monitoring membership change events.

2. Patch and upgrade steps. No patch is currently available from tracked sources. Monitor the vendor's security advisories and the advisory MMSA-2026-00677 for an updated release. Once a fixed version is published, upgrade Mattermost past the affected ranges, specifically beyond 11.9.0, 11.8.4, 11.7.7, and 10.11.22 as applicable. Deploy upgrades in a maintenance window and re-verify channel membership after the update.

3. Long-term hardening. Enforce least privilege so that only channel managers hold member-management permissions, and separate that permission from the ability to create playbook runs. Apply defense-in-depth: log and alert on all channel membership changes, periodically reconcile channel membership against approved rosters, and require administrative review for adding users to restricted channels. Apply network controls so that the Mattermost web interface is not unnecessarily exposed to the public internet, reducing the pool of authenticated attackers who can reach the vulnerable workflow.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-8821
• Mattermost Security Updates / Advisory MMSA-2026-00677: https://mattermost.com/security-updates/
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-8821
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE not listed)

No public proof-of-concept, exploit code, or Nuclei template is known. No threat actor campaign or in-the-wild exploitation evidence is available in the provided data at the time of writing.