Mattermost Improper Permission Validation in Team Member Roles API Endpoint Allowing Unauthorized Demotion to Guest Role

A vulnerability exists in Mattermost versions 10.11.x prior to 10.11.10, where the team member roles API endpoint does not properly validate permission requirements. This flaw enables team administrators to demote members to the guest role without proper authorization.

Impact

Exploitation of this vulnerability allows for unauthorized changes to team member roles, specifically demoting members to guest status, which may result in loss of access to certain features or channels.

Remediation

Users can upgrade to Mattermost version 10.11.11 or later to address this vulnerability.