GitStock

mattermost/mattermost · Security

Mattermost fails to filter invite IDs based on user permissions

Open GitHub
GHSA ID
GHSA-fx49-m253-27jj
CVE ID
CVE-2026-2463
Severity
medium
Published
Updated
CVSS
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3
4.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation. Mattermost Advisory ID: MMSA-2025-00565

CWEs

  • CWE-862 · Missing Authorization

References