Mattermost CVE-2026-9693

Exploitation requires the following concrete sequence: (1) the attacker must hold an active authenticated Mattermost account (PR:L), (2) the attacker must have a prior membership history on the target team, (3) the attacker must have been removed from or left that team at some point, and (4) an administrator must subsequently re-invite the attacker to the same team - this admin action corresponds to UI:R in the CVSS vector. Post re-invitation, the attacker queries the team threads API directly to access residual private channel thread root posts. The exposure is limited to thread root post content and metadata only - not full replies or other channel content. Exploitation is impossible against any user without prior team membership, and cannot occur without the re-invitation step, which requires an administrator to actively take action. No default configuration or unauthenticated access path exists.

The vendor-assigned CVSS 3.5 (Low) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N accurately reflects the limited real-world risk. PR:L confirms an authenticated session is required; UI:R reflects the necessary admin action of re-inviting the user, which is not something an attacker can self-trigger. The confidentiality impact is narrow (C:L), restricted to thread root post content and metadata - not full thread replies or broader channel history. No EPSS data was provided in the available intelligence, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. The multi-step precondition (prior membership, removal or departure, subsequent re-invitation) significantly limits the exploitable population in practice, making this low urgency even for organizations running affected versions. This is not a case of CVSS inflation - the score is proportionate.

An authenticated Mattermost user who was previously a member of a team containing private channels is removed by an admin or voluntarily leaves the team. At some later point, an admin re-invites that user to the same team. Upon return, the user queries the team threads API and retrieves root post content and metadata from private channel threads - content they should no longer have visibility into - due to orphaned membership records never purged at departure. No public proof-of-concept code has been identified at time of analysis.