Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:12:05 +0000 CVE-2026-15754 — Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal https://cve.radiocsirt.org/vuln/cve-2026-15754 <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost versions 11.7.x &lt;= 11.7.6, 11.8.x &lt;= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin&#39;s team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718</p> <p><strong>Affected:</strong> Mattermost</p> <p>Mattermost versions 11.7.x &lt;= 11.7.6, 11.8.x &lt;= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin&#39;s team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718</p> https://cve.radiocsirt.org/vuln/cve-2026-15754