CVE-2026-9820 Mattermost schemes teams endpoint exposes private team invite IDs
A User Manager can obtain private team invite links via the scheme teams endpoint, allowing unauthorized access to private teams.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9820?
CVE-2026-9820 is a low-severity vulnerability in Mattermost Mattermost Server, published on 13 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671
Weakness: CWE-862
Which versions are affected by CVE-2026-9820?
It affects 1 product.
Products include Mattermost Mattermost Server.
How do I fix CVE-2026-9820?
Upgrade to a fixed version.
Is CVE-2026-9820 being exploited?
There is no known exploitation of CVE-2026-9820 in the wild and no public exploit code.
Other vulnerabilities in Mattermost Mattermost Server
- CVE-2025-12419 Account takeover on OAuth/OpenID-enabled servers
- CVE-2025-12421 Account Takeover via Code Exchange Endpoint
- CVE-2025-4981 Path Traversal Leading to RCE by Any Authenticated Mattermost User
- CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards
- CVE-2025-25279 Arbitrary file read in Mattermost Boards via import & export board archive
Sources
Also known as GHSA-qvqh-cmq6-xvfq, MINI-5wf8-gqm6-55f6, MINI-pv99-78wc-2w5f.