CVE-2026-9816 lets authenticated non-guest team members grant themselves board admin privileges through two distinct paths in Mattermost Boards: the direct member insertion API and the archive import endpoint. Both fail to validate the SchemeAdmin field, allowing privilege escalation from board editor or team member to full board admin.
This isn't a one-off oversight — it's the same failure appearing in two architecturally different code paths, which signals a structural gap. Mattermost's Boards originated as Focalboard, a standalone product integrated into the platform without full alignment to Mattermost's centralized authorization model. When different developers implemented member insertion and archive import, both made the same implicit assumption: that the SchemeAdmin field in the incoming data was trusted. Neither path inherited the validation logic that Mattermost's core components enforce at the middleware layer.
The board editor constraint matters. You're not exploiting this as an unauthenticated user — you need board edit access or team membership first. But that's a low bar in Mattermost's hierarchy, and the impact is arbitrary admin grant on that board. That's a wide privilege-to-impact ratio that the CVSS score doesn't fully capture.
More critically, examine the archive import path. Bulk import endpoints are designed for data migration, not interactive use, and they routinely bypass the authorization checks that protect standard API calls. This creates an exploitation window that standard audit logs may not surface — the action looks like a legitimate data migration, not a privilege escalation. If an attacker automates member manipulation across multiple boards and teams, the lateral movement potential exceeds what the CVSS indicates.
Treat this as evidence of pattern, not incident. Any acquired component integrated into a platform's authorization framework carries the risk of parallel authorization logic that was never reconciled. Audit your Mattermost instances for other Focalboard-era features that may have similar gaps.