Unauthorized access to invite ID during team creation

published 2026-03-16 7 mo ago modified 2026-06-17 4 mo ago also GHSA-fx49-m253-27jj , GO-2026-4735 , EUVD-2026-12385

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.. Mattermost Advisory ID: MMSA-2025-00565

Patch / fix

fixed in 3 distros 2 links 1

go github.com/mattermost/mattermost/server/v8 8.0.0-20260105134819-cc427af41b2a
go github.com/mattermost/mattermost-server 5.3.2-0.20260105134819-cc427af41b2a, 10.11.11, 10.11.11+incompatible, 11.2.3, 11.2.3+incompatible, 11.3.1, 11.3.1+incompatible
Mattermost Mattermost 10.11.11, 11.2.3, 11.3.1, 11.4.0

suse opensuse

govulncheck-vulndb openSUSE Leap 15.6 0.0.20260326T203309-150000.1.155.2

suse advisories SUSE-SU-2026:1135-1

govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

github.com/mattermost/mattermost@cc427af commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-03-16)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/mattermost/mattermost/server/v8	<8.0.0-20260105134819-cc427af41b2a	8.0.0-20260105134819-cc427af41b2a
go	github.com/mattermost/mattermost-server	<5.3.2-0.20260105134819-cc427af41b2a >=10.11.0-rc1, <10.11.11 >=11.2.0-rc1, <11.2.3 >=11.3.0-rc1, <11.3.1 >=10.11.0-rc1+incompatible, <10.11.11+incompatible >=11.2.0-rc1+incompatible, <11.2.3+incompatible >=11.3.0-rc1+incompatible, <11.3.1+incompatible	5.3.2-0.20260105134819-cc427af41b2a 10.11.11 11.2.3 11.3.1 10.11.11+incompatible 11.2.3+incompatible 11.3.1+incompatible
go	github.com/mattermost/mattermost-server/v5	all versions	no fix listed
go	github.com/mattermost/mattermost-server/v6	all versions	no fix listed

Affected products

Mattermost Mattermost

Classification

Weakness

CWE-862 Missing Authorization

References

github.com /mattermost/mattermost/commit/cc427af41b2a8d3a552d8dc42978831dcfecc1d8
web
mattermost.com /security-updates
vendor-advisory, web
nvd.nist.gov /vuln/detail/CVE-2026-2463
advisory
github.com /mattermost/mattermost
package
github.com /advisories/GHSA-fx49-m253-27jj
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary