GHSA-cgjg-p2m2-qm4p

Suggest an improvement
Source
https://github.com/advisories/GHSA-cgjg-p2m2-qm4p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cgjg-p2m2-qm4p
Aliases
Published
2026-02-16T15:32:47Z
Modified
2026-04-01T17:35:38Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Mattermost fails to enforce invite permissions when updating team settings
Details

Mattermost versions 10.11.x <= 10.11.9 fail to enforce invite permissions when updating team settings, which allows team administrators without proper permissions to bypass restrictions and add users to their team via API requests. Mattermost Advisory ID: MMSA-2025-00561

Database specific 
{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-02-19T19:40:43Z",
    "nvd_published_at":  "2026-02-16T13:16:00Z",
    "severity":  "LOW"
}
References

Affected packages

Go
github.com/mattermost/mattermost/server/v8

Package

Name
github.com/mattermost/mattermost/server/v8
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost/server/v8

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.0.0-20251215190648-6404ab29acc0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
11.1.0

Database specific

last_known_affected_version_range 
"< 11.1.3"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
10.11.0

Database specific

last_known_affected_version_range 
"< 10.11.10"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
11.2.0

Database specific

last_known_affected_version_range 
"< 11.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json"
github.com/mattermost/mattermost-server

Package

Name
github.com/mattermost/mattermost-server
View open source insights on deps.dev
Purl
pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.3.2-0.20251215190648-6404ab29acc0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-cgjg-p2m2-qm4p/GHSA-cgjg-p2m2-qm4p.json"