CVE-2026-9816— Board Member Role字段验证不足导致权限提升漏洞
Possible ATT&CK Techniques 1AI
T1078 · Valid Accounts新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-9816の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Insufficient server-side validation of board member role fields permits privilege escalation
ソース: CVE Program / CVE List V5
脆弱性説明
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arbitrary users via POST /api/v2/boards/{boardID}/members and POST /api/v2/teams/{teamID}/archive/import.. Mattermost Advisory ID: MMSA-2026-00685
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
授权机制不正确
ソース: CVE Program / CVE List V5
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Mattermost | Mattermost | 11.7.0 ~ 11.7.6 | - |
II. CVE-2026-9816の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-9816のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Mattermost · 2026-08-17 · 13 CVEs total
| CVE-2026-9859 | 6.5 MEDIUM | Mattermost Boards plugin didn’t enforce role-based authorization on board channel link all |
| CVE-2026-10080 | 6.5 MEDIUM | Boards plugin panics on WebSocket command with non-string field types |
| CVE-2026-10527 | 6.3 MEDIUM | Boards plugin retains Board Admin rights for users demoted to System Guest |
| CVE-2026-16048 | 6.3 MEDIUM | Channel member roles accept out-of-scope roles |
| CVE-2026-16047 | 4.3 MEDIUM | Board channel linking without read channel permission validation |
| CVE-2026-15754 | 4.2 MEDIUM | Missing per-channel team-scope check in ABAC access control policy unassign allows cross-t |
| CVE-2026-16044 | 3.9 LOW | Insufficient validation of guest board admin privileges on archive import |
| CVE-2026-16049 | 3.9 LOW | _GitLab Plugin allows cross-channel post injection and phishing via missing channel permis |
| CVE-2026-75587 | 3.6 LOW | Plaintext pre-auth secret exposure via Desktop App diagnostics report |
| CVE-2026-9693 | 3.5 LOW | Mattermost thread memberships persist after team removal, exposing private channel thread |
| CVE-2026-16046 | 3.5 LOW | Missing run-state validation on finished playbook runs |
| CVE-2026-16045 | 2.7 LOW | Delegated OAuth tokens could revoke unrelated OAuth application authorizations |
IV. 関連脆弱性
同じ製品: Mattermost
- CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti - CVE-2026-9693
Mattermost thread memberships persist after team removal, ex - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza - CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi - CVE-2026-10527
Boards plugin retains Board Admin rights for users demoted t
同じベンダー: Mattermost
- CVE-2026-75587
Plaintext pre-auth secret exposure via Desktop App diagnosti - CVE-2026-9693
Mattermost thread memberships persist after team removal, ex - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza - CVE-2026-10080
Boards plugin panics on WebSocket command with non-string fi - CVE-2026-10527
Boards plugin retains Board Admin rights for users demoted t
同じ弱点: CWE-863
- CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Acc - CVE-2026-9859
Mattermost Boards plugin didn’t enforce role-based authoriza - CVE-2026-11817
CVE-2026-11817 CVE Record - CVE-2026-71518
Typemill < 2.26.0 Authorization Bypass via Media File Downlo - CVE-2026-44846
JumpServer: Privilege Overwrite via Organization Invite Logi
V. CVE-2026-9816へのコメント
まだコメントはありません