GitHub Advisoryadvisory · Go

GHSA-fx49-m253-27jj Mattermost fails to filter invite IDs based on user permissions

MEDIUM Published 2026-03-16 Modified 2026-03-17 Official page ↗
Aliases
CVE-2026-2463
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8, github.com/mattermost/mattermost-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2026-03-17

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.0.0-20260105134819-cc427af41b2a → fixed in 8.0.0-20260105134819-cc427af41b2a • Go github.com/mattermost/mattermost-server: < 5.3.2-0.20260105134819-cc427af41b2a → fixed in 5.3.2-0.20260105134819-cc427af41b2a • Go github.com/mattermost/mattermost-server: >= 10.11.0-rc1, < 10.11.11 → fixed in 10.11.11 • Go github.com/mattermost/mattermost-server: >= 11.2.0-rc1, < 11.2.3 → fixed in 11.2.3 • Go github.com/mattermost/mattermost-server: >= 11.3.0-rc1, < 11.3.1 → fixed in 11.3.1

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation. Mattermost Advisory ID: MMSA-2025-00565

Related

Alias · CVE (1)

  • CVE-2026-2463 Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References