CVE-2026-9820: Mattermost Server Auth Bypass Vulnerability

CVE-2026-9820 Overview

CVE-2026-9820 is an authorization flaw in Mattermost Server that exposes private team invite links through the scheme teams API endpoint. The issue affects Mattermost versions 11.7.x up to and including 11.7.2, and versions 10.11.x up to and including 10.11.19. The endpoint fails to sanitize team objects it returns, allowing a user holding the User Manager role to read invite links for private teams. That user can then join those private teams or share the invite links with others. Mattermost tracks the issue under advisory MMSA-2026-00671 and classifies it as a missing authorization weakness [CWE-862].

Critical Impact
A User Manager can enumerate invite links for private teams and gain unauthorized access, breaking tenant and workspace isolation assumptions.

Affected Products

Mattermost Server 11.7.0 through 11.7.2
Mattermost Server 10.11.0 through 10.11.19
Deployments exposing the scheme teams API endpoint to User Manager role holders

Discovery Timeline

2026-07-13 - CVE-2026-9820 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-9820

Vulnerability Analysis

Mattermost implements role-based access control that separates administrative capabilities from full system administration. The User Manager role is intended to manage users and team membership, not to view private team configuration. The scheme teams endpoint returns team objects that include sensitive fields, including invite identifiers used to construct join URLs. The endpoint does not filter these fields based on the caller's relationship to the target team. As a result, a User Manager can read invite metadata for teams they were never granted access to.

Invite links in Mattermost function as bearer tokens. Any actor holding a valid invite identifier can join the corresponding team without further authorization checks. The disclosure of invite links therefore translates directly into unauthorized team membership.

Root Cause

The root cause is missing authorization on response data [CWE-862]. The scheme teams handler serializes full team objects instead of a redacted projection scoped to the caller's permissions. The controller enforces authorization for reaching the endpoint but does not re-check per-field access before returning invite properties.

Attack Vector

Exploitation requires an authenticated account with the User Manager role and network access to the Mattermost API. The attacker issues a request to the scheme teams endpoint and parses the returned team objects for invite identifiers belonging to private teams. The attacker then constructs the corresponding invite URL and either joins directly or distributes the link to third parties. No user interaction is required on the victim side, and no memory corruption or code execution occurs. The impact is limited to confidentiality and integrity of team membership boundaries.

See the Mattermost Security Updates advisory for the vendor's technical description.

Detection Methods for CVE-2026-9820

Indicators of Compromise

API access log entries showing calls to the scheme teams endpoint originating from accounts with the User Manager role rather than System Admin
New team join events for private teams where the joining user was not invited through the normal workflow
Invite link usage from IP addresses or user agents that do not correspond to the team owner or existing members

Detection Strategies

Query Mattermost audit logs for repeated GET requests against the scheme teams API endpoint by non-administrator accounts
Correlate team membership changes on private teams with prior scheme teams endpoint reads by the same actor within a short time window
Alert when a User Manager account accesses team objects for teams they are not a member of

Monitoring Recommendations

Forward Mattermost application and audit logs to a centralized logging pipeline and retain them for at least 90 days
Baseline expected API consumers for the scheme teams endpoint and alert on deviations
Review User Manager role assignments quarterly and remove the role from accounts that no longer require it

How to Mitigate CVE-2026-9820

Immediate Actions Required

Upgrade Mattermost Server to a fixed release beyond 11.7.2 for the 11.7.x branch or beyond 10.11.19 for the 10.11.x branch
Audit accounts holding the User Manager role and revoke the role where it is not strictly required
Rotate invite links for private teams that may have been exposed prior to patching

Patch Information

Mattermost has issued fixes through advisory MMSA-2026-00671. Refer to the Mattermost Security Updates page for the specific patched build numbers and release notes. Apply the update through the standard Mattermost upgrade procedure and verify the running version after restart.

Workarounds

Restrict the User Manager role to trusted administrators until the patch is applied
Disable invite links for private teams and require manual invitation by team admins
Place the Mattermost API behind a reverse proxy that logs and rate-limits calls to the scheme teams endpoint

bash

# Verify installed Mattermost Server version
mattermost version

# List users assigned the User Manager role via mmctl
mmctl user list --team --all
mmctl permissions role show system_user_manager