CVE-2026-7387: Mattermost group syncable endpoints allow privilege escalation via scheme_admin

Synopsis

This is a privilege escalation vulnerability in Mattermost, a self-hosted team messaging platform. The flaw is reachable over the network and requires only a low-privilege account; no victim interaction is needed. A user with group-link permissions can send crafted API requests to the group syncable link and patch endpoints to set the scheme_admin flag without proper authorization checks, elevating themselves or other group members to team or channel administrator. Patched-image rebuilds at versions 10.11.16, 10.11.17, 11.5.5, 11.6.2, and 11.7.0 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoints are exposed over the network, so an attacker must be able to reach the Mattermost server via HTTP/S.

• AuthenticationRequired

  Any low-privilege Mattermost account with group-link permissions is sufficient; no admin credentials are needed.

• Victim interactionNot required

  The attacker sends crafted API requests directly; no action from another user is required.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads sensitive channel and team membership data accessible to the newly elevated admin role.
• Modifies team and channel settings, membership lists, and permissions for any group members the attacker promotes.
• Grants persistent admin-level access that survives password resets or session expiry until the privilege assignment is revoked.
• Disrupts organizational access controls by silently elevating unprivileged users to team or channel administrator.