CVE-2026-9693: Mattermost Server Information Disclosure

CVE-2026-9693 Overview

CVE-2026-9693 affects Mattermost Server versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5. The application fails to remove thread membership records when a user is removed from or leaves a team. A previously removed user who is later re-invited to the team can view private channel thread root post content and metadata through the team threads API. Mattermost tracks this issue under advisory MMSA-2026-00682. The weakness maps to CWE-459: Incomplete Cleanup and results in unauthorized information disclosure across team membership changes.

Critical Impact
Re-invited users can read private channel thread root post content and metadata they should no longer have access to, resulting in unintended disclosure of confidential collaboration data.

Affected Products

Mattermost Server 10.11.x up to and including 10.11.20
Mattermost Server 11.7.x up to and including 11.7.5
Mattermost Team Threads API endpoints exposing thread membership state

Discovery Timeline

2026-08-17 - CVE-2026-9693 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-9693

Vulnerability Analysis

Mattermost maintains ThreadMembership records that link users to threads they follow or have interacted with inside channels. When an administrator removes a user from a team, or the user leaves voluntarily, Mattermost revokes team and channel memberships but does not delete the associated thread membership rows. The stale records remain in the database indefinitely.

If the same user is later re-invited to the team, the server treats the residual thread membership as valid state. Requests to the team threads API return root post content and metadata for private channel threads the user previously followed. This bypasses the access recheck that should occur after a membership gap, exposing private channel data across authorization boundaries.

Root Cause

The root cause is incomplete cleanup [CWE-459]. Removal and leave workflows do not cascade deletion to ThreadMembership entries scoped to the affected team's private channels. The team threads API trusts persisted membership state rather than re-validating channel access at query time.

Attack Vector

Exploitation requires an authenticated Mattermost account and user interaction across a membership lifecycle. An attacker who was previously a member of a team, followed threads in private channels, and was later removed can wait for re-invitation. Upon rejoining, the attacker queries the team threads API to retrieve root post content and metadata for threads they should not access. The vulnerability is exploitable over the network against any Mattermost instance running an affected version.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this issue at the time of writing.

Detection Methods for CVE-2026-9693

Indicators of Compromise

Team threads API responses returning private channel thread root posts to users who were recently re-added to a team
Presence of ThreadMembership rows referencing channels the user is not currently a member of
API access patterns showing bulk thread enumeration shortly after a team join event

Detection Strategies

Audit the ThreadMembership table for entries whose UserId lacks a corresponding active ChannelMembers row for the referenced channel
Correlate LeaveTeam and AddUserToTeam audit events with subsequent GET /api/v4/users/{user_id}/teams/{team_id}/threads calls
Alert on threads API queries returning results from private channels the requesting user rejoined within a short time window

Monitoring Recommendations

Forward Mattermost audit logs and API access logs to a centralized log platform for correlation and retention
Track team membership churn events alongside thread API request volume per user
Review Mattermost administrator activity reports for repeated remove-and-reinvite patterns targeting the same user

How to Mitigate CVE-2026-9693

Immediate Actions Required

Upgrade Mattermost Server to a version above 10.11.20 on the 10.11.x branch or above 11.7.5 on the 11.7.x branch as published by the vendor
Identify users who left or were removed from teams containing private channels and were later re-invited, then review their recent threads API activity
Purge orphaned ThreadMembership records referencing channels the user is no longer authorized to access

Patch Information

Mattermost has published fixed releases through the Mattermost Security Updates page. Administrators should apply the vendor patch that addresses advisory MMSA-2026-00682. Follow the standard Mattermost upgrade procedure for the deployment method in use, including database migrations that clean up stale thread membership state.

Workarounds

Avoid re-inviting previously removed users into teams that contain sensitive private channels until the patch is applied
When re-invitation is required, rotate or archive private channels the user previously accessed to sever residual thread references
Restrict team administrator privileges to reduce the number of accounts able to trigger the remove-reinvite lifecycle

bash

# Configuration example: identify orphaned ThreadMembership rows in PostgreSQL
# Run as a read-only query first; validate results before deletion.
SELECT tm.PostId, tm.UserId, c.Id AS ChannelId, c.Type
FROM ThreadMemberships tm
JOIN Posts p ON p.Id = tm.PostId
JOIN Channels c ON c.Id = p.ChannelId
LEFT JOIN ChannelMembers cm
  ON cm.ChannelId = c.Id AND cm.UserId = tm.UserId
WHERE c.Type = 'P'
  AND cm.UserId IS NULL;