CVE-2026-91181: Mattermost Auth Bypass Vulnerability

CVE-2026-91181 Overview

CVE-2026-91181 is an authorization flaw in Mattermost that exposes sensitive team metadata through the data retention API. The affected endpoint GET /api/v4/data_retention/policies/{policy_id}/teams fails to sanitize Team objects before returning them to the caller. An authenticated user holding only the read-only Data Retention Policy permission can retrieve a private team's invite_id and associated email, then use that invite_id to join the team without further authorization. The issue is tracked as Mattermost Advisory ID MMSA-2026-00702 and maps to [CWE-863: Incorrect Authorization].

Critical Impact
A low-privileged authenticated user can join private Mattermost teams and access confidential channels by harvesting leaked invite_id values from the data retention endpoint.

Affected Products

Mattermost 11.9.x versions <= 11.9.0
Mattermost 11.8.x versions <= 11.8.4
Mattermost 11.7.x versions <= 11.7.7
Mattermost 10.11.x versions <= 10.11.22

Discovery Timeline

2026-09-14 - CVE-2026-91181 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91181

Vulnerability Analysis

The vulnerability resides in the Mattermost data retention API surface. The endpoint GET /api/v4/data_retention/policies/{policy_id}/teams returns full Team objects associated with a data retention policy. These objects include fields intended only for team administrators, such as invite_id and the team contact email.

Mattermost enforces access to this endpoint using the Data Retention Policy permission, which is designed as a read-only administrative capability for compliance reviewers. The endpoint does not, however, filter object fields against the caller's membership in each returned team. As a result, a compliance user with no membership in a private team receives that team's secret join token.

Because the invite_id doubles as a bearer credential for the team-join workflow, disclosure is functionally equivalent to granting membership. The attacker converts information disclosure into an authorization bypass without any additional exploit primitive.

Root Cause

The root cause is missing output sanitization in the data retention teams handler. The service serializes the full Team model rather than a scoped data transfer object. Field-level access control is not applied based on team membership, so sensitive attributes flow through the response regardless of the caller's relationship to the team.

Attack Vector

An attacker first obtains an account with the Data Retention Policy permission. This role is commonly assigned to auditors, compliance staff, or delegated administrators. The attacker enumerates policy IDs and issues GET requests against /api/v4/data_retention/policies/{policy_id}/teams. The response body includes each team's invite_id. The attacker then submits the invite_id to the standard team-join endpoint and gains membership in private teams they were never authorized to access. Refer to the Mattermost Security Updates advisory for protocol-level details.

Detection Methods for CVE-2026-91181

Indicators of Compromise

Unexpected GET requests to /api/v4/data_retention/policies/{policy_id}/teams from accounts that do not perform routine compliance work.
New team memberships created via invite_id join flows shortly after data retention endpoint access by the same user.
Enumeration patterns where a single session iterates through multiple policy_id values in a short window.

Detection Strategies

Correlate application audit logs for the data retention teams endpoint against subsequent POST /api/v4/teams/members/invite or invite_id-based join events per user.
Alert on any user with the Data Retention Policy role gaining membership in a team where they were not previously listed.
Baseline normal call volume to /api/v4/data_retention/policies/*/teams and flag deviations that suggest scripted enumeration.

Monitoring Recommendations

Forward Mattermost audit and API access logs to a centralized analytics platform for retention and correlation.
Review Data Retention Policy role assignments on a recurring cadence and confirm each assignee still requires the permission.
Track team membership changes for private teams and require approval workflows for out-of-band joins.

How to Mitigate CVE-2026-91181

Immediate Actions Required

Upgrade Mattermost to a fixed release above 11.9.0, 11.8.4, 11.7.7, or 10.11.22 as published in the Mattermost Security Updates advisory.
Audit all accounts currently holding the Data Retention Policy permission and remove the role where it is not strictly required.
Rotate invite_id values on private teams that may have been exposed by prior calls to the vulnerable endpoint.

Patch Information

Mattermost addressed the issue in versions above 11.9.0, 11.8.4, 11.7.7, and 10.11.22. The fix sanitizes Team objects returned by /api/v4/data_retention/policies/{policy_id}/teams so that invite_id and email fields are not exposed to callers who lack team membership. Advisory MMSA-2026-00702 documents the corrected behavior.

Workarounds

Temporarily revoke the Data Retention Policy permission from all non-essential users until the patch is applied.
Regenerate invite_id values on sensitive private teams to invalidate any tokens already harvested.
Restrict network access to the Mattermost API from administrative CIDR ranges only, reducing exposure to compromised auditor accounts.

bash

# Rotate invite IDs on a private team using the Mattermost CLI
mmctl team modify <team-name> --regenerate-invite-id

# Remove the Data Retention Policy read permission from a role
mmctl permissions remove <role-name> sysconsole_read_compliance_data_retention