EUVD-2026-36501
GHSA-c28q-m4gf-vg4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible API requiring low-privilege authentication (PR:L); integrity-only impact as only invite configuration is affected, with no data exposure or service disruption.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655
AnalysisAI
Mattermost's team creation API endpoint (POST /api/v4/teams) fails to enforce the PermissionInviteUser authorization check, allowing authenticated users holding only PermissionCreateTeam to configure invite-controlled team settings - including making a team publicly joinable via open invite and restricting membership by allowed domains - that they are explicitly prohibited from setting on existing teams. Affected versions span the 10.11.x, 11.5.x, and 11.6.x release trains up to their respective latest builds. No public exploit identified at time of analysis, and the flaw has not been listed in CISA KEV.
Technical ContextAI
Mattermost is a self-hosted and cloud-deployed team collaboration platform with a granular, role-based permission system. The REST API exposes team management via POST /api/v4/teams (creation) and PATCH/PUT endpoints (update). The platform distinguishes PermissionCreateTeam, which governs the ability to instantiate a new team, from PermissionInviteUser, which governs the ability to configure how users may be invited or admitted to a team. The fields AllowOpenInvite (makes a team publicly discoverable and joinable without an explicit invitation) and AllowedDomains (restricts membership to specified email domains) are invite-related settings that should require PermissionInviteUser. The root cause is CWE-862 (Missing Authorization): the PermissionInviteUser check was implemented on the update/patch code path but was entirely omitted from the creation code path. This is a classic authorization inconsistency across alternate execution paths - the same business logic constraint was not uniformly enforced across all API surfaces that mutate the same data. CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade Mattermost to a version beyond the affected ranges (past 11.6.1, 11.5.4, or 10.11.16 as applicable to the installed release train) per Mattermost advisory MMSA-2026-00655 at https://mattermost.com/security-updates. Exact patched release version numbers are not specified in the available advisory data and should be confirmed directly from the vendor before deployment. As a compensating control pending upgrade, administrators should audit and restrict the PermissionCreateTeam grant to only highly trusted users or dedicated service accounts - this shrinks the population of principals who could exploit the bypass, though it may constrain legitimate team creation workflows. Additionally, administrators should audit all teams created on affected versions to verify that AllowOpenInvite and AllowedDomains settings reflect intended organizational policy, as any team created during the vulnerable window by a user without PermissionInviteUser may have unauthorized invite settings.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today