CVE-2026-9820

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9820
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9820.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9820
Downstream
Published
2026-07-13T10:51:34.023Z
Modified
2026-07-16T03:45:44.742474427Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Mattermost schemes teams endpoint exposes private team invite IDs
Details

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

Database specific 
{
    "cna_assigner": "Mattermost",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9820.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.7.0"
                },
                {
                    "last_affected": "11.7.2"
                },
                {
                    "introduced": "10.11.0"
                },
                {
                    "last_affected": "10.11.19"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/mattermost/mattermost

Affected ranges

Type
GIT
Repo
https://github.com/mattermost/mattermost
Events
Introduced
5b955468ea1ea8b56c0fb10feb258a36a767d7bb
Fixed
31b97d9ee1e020ca63f2169e4daab4aa0519a727
Introduced
a9e574a82633915f22071f0d7ca2b006f249ec2a
Fixed
28b63b15f73e0ed02d0da0018e06d88c47a77c48
Database specific 
{
    "cpe": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "10.11.0"
        },
        {
            "fixed": "10.11.20"
        },
        {
            "introduced": "11.7.0"
        },
        {
            "fixed": "11.7.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

@mattermost/client@10.*
@mattermost/client@10.11.0
@mattermost/client@11.*
@mattermost/client@11.7.0
@mattermost/shared@11.*
@mattermost/shared@11.7.0
@mattermost/types@10.*
@mattermost/types@10.11.0
@mattermost/types@11.*
@mattermost/types@11.7.0
mattermost-redux@10.*
mattermost-redux@10.11.0
mattermost-redux@11.*
mattermost-redux@11.7.0
v10.*
v10.11.0
v10.11.0-rc3
v10.11.1
v10.11.1-rc1
v10.11.10
v10.11.11
v10.11.11-rc1
v10.11.11-rc2
v10.11.12
v10.11.13
v10.11.13-rc1
v10.11.14
v10.11.14-rc1
v10.11.15
v10.11.15-rc1
v10.11.16
v10.11.17
v10.11.18
v10.11.19
v10.11.19-rc1
v10.11.2
v10.11.2-rc1
v10.11.2-rc2
v10.11.3
v10.11.4
v10.11.4-rc1
v10.11.4-rc2
v10.11.4-rc3
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.11.9
v10.11.9-rc1
v11.*
v11.7.0
v11.7.1
v11.7.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9820.json"