What is the CVSS score of EUVD-2026-43340?

EUVD-2026-43340 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Mattermost EUVD-2026-43340

| CVE-2026-9820 LOW

Missing Authorization (CWE-862)

2026-07-13 Mattermost

Authentication Bypass Mattermost

3.8

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.8 LOW

User Manager role is a high-privilege prerequisite (PR:H); network API access is straightforward (AV:N, AC:L); impact is limited to invite-link disclosure (C:L) and unauthorized team membership (I:L) with no availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

AnalysisAI

Insufficient sanitization of team objects in Mattermost's scheme teams API endpoint allows an authenticated user holding the User Manager role to extract invite links for private teams from API responses and use those links to join or redistribute access to those teams. Affected versions are 11.7.x through 11.7.2 and 10.11.x through 10.11.19. No public exploit identified at time of analysis and exploitation has not been confirmed by CISA KEV, but the low attack complexity (AC:L) means a malicious User Manager could reliably reproduce this without trial and error.

Technical ContextAI

Mattermost is a self-hostable team messaging platform. The vulnerability resides in the scheme teams endpoint, which returns team objects used to manage permission schemes. CWE-862 (Missing Authorization) describes the root cause: the application retrieves and returns team object fields - including invite links - without filtering them to the caller's authorization scope. The User Manager role is a built-in administrative role intended for user lifecycle management, not team access control; the endpoint should strip or redact fields like invite links before returning objects to roles that lack private-team visibility. The CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* covers the Mattermost server application across all affected version branches.

RemediationAI

Upgrade Mattermost to a version beyond the affected ranges: apply the fix released for the 11.7.x branch (version above 11.7.2) or the 10.11.x branch (version above 10.11.19) as documented at https://mattermost.com/security-updates. If an immediate upgrade is not possible, audit and restrict assignment of the User Manager role to the minimum necessary accounts, as this reduces the exploitable surface to only those trusted administrators. Additionally, review audit logs for unexpected calls to the scheme teams API endpoint by User Manager accounts that do not have a business need to access scheme configuration. No workaround fully eliminates the risk without patching, since the flaw is in server-side response sanitization; role restriction is a compensating control only.