PT-2026-48937 · Mattermost · Mattermost
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Mattermost versions 11.6.0 through 11.6.1
Mattermost versions 11.5.0 through 11.5.4
Mattermost versions 10.11.0 through 10.11.16
Description
An issue exists where the system fails to enforce the
PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the creation of a team. This occurs because the permission check was only applied during update or patch operations. Consequently, an authenticated user with PermissionCreateTeam but without PermissionInviteUser can configure invite-controlled settings, such as making a team publicly joinable via open invite or constraining membership through allowed domains. This is achievable via the 'POST /api/v4/teams' endpoint by including allow open invite: true and/or a non-empty allowed domains in the request body.Recommendations
Update Mattermost versions 11.6.0 through 11.6.1 to a version later than 11.6.1.
Update Mattermost versions 11.5.0 through 11.5.4 to a version later than 11.5.4.
Update Mattermost versions 10.11.0 through 10.11.16 to a version later than 10.11.16.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mattermost