GHSA-fx49-m253-27jj

ghsaUSosv

Mattermost fails to filter invite IDs based on user permissions

view advisory published 2026-03-16Licence: CC-BY-4.0

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation. Mattermost Advisory ID: MMSA-2025-00565

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-2463US	—OT elevated	0.17% (7th)	—	2026-03-16
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to bypass access control…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://github.com/mattermost/mattermost/commit/cc427af41b2a8d3a552d8dc42978831dcfecc1d8WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-2463ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan