CVE-2026-2463CWE-862

Unauthorized access to invite ID during team creation

Medium · published March 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
6.4
In the wild
Unconfirmed
What it is

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.. Mattermost Advisory ID: MMSA-2025-00565

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00173 · 6.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-16T11:13Z
EPSS history
Timeline
  • 16 MAR 11:13Z
    Unauthorized access to invite ID during team creation
    cvelistv5