Group syncable scheme_admin authorization bypass (CVE-2026-7387)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledserver/channels/api4/group.go:354

   linkGroupSyncable()

2. 1
   Step 01server/channels/api4/group.go:354-358

   The link endpoint decodes the request body into GroupSyncablePatch. A caller can include scheme_admin in the same JSON body used for ordinary syncable settings such as auto_add.

   var patch *model.GroupSyncablePatch
   err = json.Unmarshal(body, &patch)
   if err != nil {
       c.SetInvalidParamWithErr("group_syncable", err)
       return
   }
   

3. 2
   Step 02server/public/model/group_syncable.go:167-169

   The model patch helper copied SchemeAdmin directly into the syncable object. It had no authorization context, so it could not distinguish harmless configuration changes from role-granting changes.

   if patch.SchemeAdmin != nil {
       syncable.SchemeAdmin = *patch.SchemeAdmin
   }
   

4. 3
   Step 03server/channels/api4/group.go:372-381 (before fix)

   Before PR #36316, the API persisted the patched object after the weaker link permission checks. The same missing role-management gate existed in the patch endpoint.

   groupSyncable := &model.GroupSyncable{
       GroupId:    c.Params.GroupId,
       SyncableId: syncableID,
       Type:       syncableType,
   }
   groupSyncable.Patch(patch)
   groupSyncable, appErr = c.App.UpsertGroupSyncable(groupSyncable)
   

5. 4
   Step 04server/channels/api4/group.go:387-389 (before fix)

   Persisting the syncable triggered asynchronous role and membership synchronization. A caller-controlled SchemeAdmin bit therefore flowed from the request body into background role changes.

   c.App.Srv().Go(func() {
       c.App.SyncRolesAndMembership(c.AppContext, syncableID, syncableType, c.Params.GroupId)
   })
   

6. 5
   Step 05server/channels/store/sqlstore/group_store.go:1832-1836

   The sync path asks the store for group members whose linked syncable has SchemeAdmin = TRUE. That turns the persisted client-controlled field into the list of users who should become admins.

   builder := s.getQueryBuilder().Select("UserId").
       From(fmt.Sprintf("Group%ss", syncableType)).
       Join(fmt.Sprintf("GroupMembers ON GroupMembers.GroupId = Group%ss.GroupId AND Group%[1]ss.SchemeAdmin = TRUE AND GroupMembers.DeleteAt = 0", syncableType.String()))
   

7. 6
   Step 06server/channels/store/sqlstore/team_store.go:1617-1625

   The selected user IDs are written into team membership state as scheme admins. The channel path uses the same pattern for channel members.

   func (s SqlTeamStore) UpdateMembersRole(teamID string, userIDs []string) ([]*model.TeamMember, error) {
       query := s.getQueryBuilder().
           Update("TeamMembers").
           Set("SchemeAdmin", sq.Case().When(sq.Eq{"UserId": userIDs}, "true").Else("false"))
   }
   

8. 7
   Step 07server/channels/api4/group.go:739-766 (fix, commit 8c72083)

   The fix gates any explicit SchemeAdmin value on the same role-management permissions used by direct role assignment, or on the sysconsole groups-management permission.

   func verifySchemeAdminAssignmentPermission(c *Context, syncableType model.GroupSyncableType, syncableID string, patch *model.GroupSyncablePatch) *model.AppError {
       if patch == nil || patch.SchemeAdmin == nil {
           return nil
       }
   
       if c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteUserManagementGroups) {
           return nil
       }
   
       switch syncableType {
       case model.GroupSyncableTypeTeam:
           if !c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), syncableID, model.PermissionManageTeamRoles) {
               return model.MakePermissionError(c.AppContext.Session(), []*model.Permission{model.PermissionManageTeamRoles})
           }
       case model.GroupSyncableTypeChannel:
           if ok, _ := c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), syncableID, model.PermissionManageChannelRoles); !ok {
               return model.MakePermissionError(c.AppContext.Session(), []*model.Permission{model.PermissionManageChannelRoles})
           }
       }
   
       return nil
   }
   

9. Sinkserver/channels/store/sqlstore/team_store.go:1617

   UpdateMembersRole()