Mattermost CVE-2026-91181

Exploitation requires: (1) Mattermost Enterprise with the Data Retention Policy feature enabled and at least one policy configured; (2) an authenticated user account that has been granted the read-only Data Retention Policy system role - this is NOT a default role and must be explicitly assigned by a system admin; (3) at least one private team associated with a data retention policy. What limits exploitation: the attacker must already be an authenticated Mattermost user on the same server; the vulnerable role is an enterprise-only administrative role not present in Team Edition or in accounts without explicit assignment; exploitation requires knowing or enumerating a valid policy_id (accessible to the same role). There is no unauthenticated or default-configuration attack path.

The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) accurately reflects the network-reachable API, low complexity once the role is held, and significant confidentiality and integrity impact. PR:H is defensible since Data Retention Policy is an enterprise-tier administrative role not granted to ordinary users, but it warrants scrutiny: in some Mattermost deployments, compliance auditors receive this role without broader admin privileges, making it a lower-trust identity than PR:H implies. There is no KEV listing and no reported POC, so real-world exploitation is opportunistic rather than widespread. EPSS data was not provided in the input. The practical blast radius is limited to organizations that (a) run Mattermost Enterprise with Data Retention enabled and (b) have granted the read-only Data Retention Policy role to users who should not access private teams. In such deployments the impact is material - a compliance auditor silently joining and reading private executive or HR channels without authorization. For deployments without Data Retention licensing or where only super-admins hold the role, risk is negligible.

A compliance auditor account is granted the read-only Data Retention Policy role in a Mattermost Enterprise deployment. The auditor issues a single authenticated GET request to /api/v4/data_retention/policies/{policy_id}/teams, receiving full Team objects including the invite_id of a private executive channel. The auditor constructs an invite URL using that token and silently joins the private team, gaining read access to confidential communications without any administrator granting team membership.