CVE-2026-9820

3.8 Faible

Publiée le 13/07/2026 à 13:16 · Modifiée le 13/07/2026 à 22:38 · Analysée par le NVD · Source : responsibledisclosure@mattermost.com

Description

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

Traduire en français

Produits concernés

Mattermost
Mattermost mattermost server

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.8 Faible	responsibledisclosure@mattermost.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://mattermost.com/security-updates Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories