CVE-2026-9820
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability in Mattermost allows a user with the User Manager role to obtain invite links for private teams via the scheme teams endpoint. Lack of proper sanitization of team objects enables joining or sharing access to those teams.
Risk Assessment
The organization is at risk of unauthorized access to private teams, potentially leading to leakage of confidential information and breach of access policies.
Recommendation
Update Mattermost immediately to version 11.7.3 or later (for 11.7.x series) and to version 10.11.20 or later (for 10.11.x series).
Original NVD description (English source)
Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671