Mattermost EUVD-2026-102748

Exploitation requires an authenticated Mattermost user who obtains a valid team or guest invitation token (link) that was forwarded or leaked and was originally issued to a different recipient's email address; the vulnerable server redeems the token without verifying that the redeeming account's email matches the invited recipient. Limiting factors: the attacker must already have an authenticated account, must acquire an unexpired/unredeemed invite token (reflected in AC:H - not attacker-controlled), and the instance must run an affected version (11.7.x≤11.7.9, 11.8.x≤11.8.5, 11.9.x≤11.9.1, 11.10.x≤11.10.0). There is no remote unauthenticated path and no user interaction by a victim is required.

This is a moderate-severity authorization flaw (CWE-863, CVSS 5.0) rather than a top-tier priority. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N reflects the central limiting factor: although the attack vector is network (AV:N), both high attack complexity (AC:H) and high privileges (PR:H) are required, because the attacker must already be authenticated AND must obtain a valid but leaked or forwarded invitation token - conditions outside the attacker's direct control. No EPSS score, KEV listing, or POC is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The confidentiality impact is rated High (unauthorized access to private channel contents) while integrity is Low (joining a team/channel) and availability is unaffected. Signals are internally consistent and point to a targeted, opportunistic issue (exploitable only when an invite link leaks) rather than a wormable, mass-exploitable vulnerability. One note of caution: the vendor-assigned PR:H appears conservatively high for a flaw whose practical barrier is possessing a leaked invite rather than holding elevated privileges - verify the intended privilege model with Mattermost, as a PR:L interpretation would modestly raise the score.

An authenticated Mattermost user obtains a team or guest invitation link that was forwarded, shared, or leaked (e.g., via a mistakenly CC'd email, a chat paste, or a reused link) that was intended for a different recipient's email address. Because the server does not validate that the redeeming user's email matches the invited recipient, the attacker redeems the token and joins the team or gains access to private channels they were never authorized for. No public exploit code is identified at time of analysis, and the attack depends on acquiring a valid leaked token.