CVE-2026-9820CWE-862

Mattermost schemes teams endpoint exposes private team invite IDs

Low · published July 13, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-13T10:51Z
EPSS history
Timeline
  • 13 JUL 10:51Z
    Mattermost schemes teams endpoint exposes private team invite IDs
    cvelistv5