Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to escalate themselves and group members to team or channel admin via crafted API requests. Mattermost Advisory ID: MMSA-2026-00665

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-7387

• https://mattermost.com/security-updates

• mattermost/mattermost#36316

• mattermost/mattermost#36423

• mattermost/mattermost#36431

• mattermost/mattermost#36432

• mattermost/mattermost#36434

• mattermost/mattermost@1ce2484

• mattermost/mattermost@202d125

• mattermost/mattermost@8c72083

• mattermost/mattermost@a9e574a

• mattermost/mattermost@d5f29c8

• https://github.com/mattermost/mattermost/releases/tag/v10.11.16

• https://github.com/mattermost/mattermost/releases/tag/v11.5.5

• https://github.com/mattermost/mattermost/releases/tag/v11.6.2

• https://github.com/mattermost/mattermost/releases/tag/v11.7.0