PT-2026-25679 · Mattermost · Mattermost

Omarahmed1 · Published 2026-02-13 · Updated 2026-03-27 · CVE-2026-2463

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0

Description Mattermost does not properly filter invite IDs based on user permissions. This allows regular users to bypass access control restrictions and register unauthorized accounts using leaked invite IDs during team creation.

Recommendations Update Mattermost to a version later than 10.11.10. Update Mattermost to a version later than 11.2.2. Update Mattermost to a version later than 11.3.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-06573

CVE-2026-2463

GHSA-FX49-M253-27JJ

GO-2026-4735

SUSE-SU-2026:1135-1

Affected Products

Mattermost

References · 151

• https://osv.dev/vulnerability/GHSA-fx49-m253-27jj · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2463 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2463 · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4735 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/cc427af41b2a8d3a552d8dc42978831dcfecc1d8 · Note
• https://suse.com/security/cve/CVE-2026-22545 · Note
• https://suse.com/security/cve/CVE-2026-33281 · Note
• https://suse.com/security/cve/CVE-2026-33132 · Note
• https://suse.com/security/cve/CVE-2026-33191 · Note
• https://suse.com/security/cve/CVE-2026-33066 · Note
• https://suse.com/security/cve/CVE-2026-33315 · Note