VULNERABILITY INTELLIGENCE

CVE-2026-9820

CVSS score3.8 LOW
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-07-13
Last modified2026-07-13
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Description

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

Weakness classification

  • responsibledisclosure@mattermost.com: CWE-862

Primary references