CVEvulnerability

CVE-2026-9820

3.8 LOW Published 2026-07-13 Modified 2026-07-13 Official page ↗
Status
Analyzed
Published
2026-07-13
Last modified
2026-07-13
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.8 LOW — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-862

Description

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

Affected configurations

• mattermost mattermost server (>= 10.11.0 < 10.11.20) • mattermost mattermost server (>= 11.7.0 < 11.7.3)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References