CVE-2026-18223

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, and 10.5.x <= 10.5.12 fail to verify that the token used during code exchange originates from the same authentication flow. This allows an authenticated user to perform account takeover via a crafted email address when switching authentication methods and sending a request to /users/login/sso/code-exchange. It requires ExperimentalEnableAuthenticationTransfer enabled (default) and RequireEmailVerification disabled (default).

Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, and 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication. This allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data in the OAuth completion flow. It requires email verification disabled (default), OAuth/OpenID Connect enabled, and the attacker controlling two SSO users, one of whom never logged into Mattermost.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion WebSocket events and returning thread API responses. An authenticated channel member can obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted WebSocket event or the threads REST API.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries. An attacker with access to server logs can obtain valid session tokens or OAuth access tokens and impersonate authenticated users.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint. An attacker with a valid OAuth bearer token for a target user can permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports. An authenticated attacker with team admin privileges can force-add existing Mattermost users to their team and forge posts attributed to those users' identities.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user's permissions before other validations, allowing non-content reviewers to infer a post's flagged status via direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results. An authenticated user without permission to list private teams can disclose the ID, name, and display name of private teams via a modified team search request.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches. A remote attacker can cause memory exhaustion on the server via a crafted oversized image response.