1. Home
  2. CVE Database
  3. CVE-2026-9820
LOW · 3.8

CVE-2026-9820

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for...

Vulnerability Description

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671

CVSS Score

3.8

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
MattermostMattermost Server>= 10.11.0, < 10.11.20

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2026-9820?

CVE-2026-9820 is a vulnerability with a CVSS score of 3.8 (LOW). Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for...

How severe is CVE-2026-9820?

CVE-2026-9820 has been rated LOW with a CVSS base score of 3.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-9820?

Check the references section above for vendor advisories and patch information. Affected products include: Mattermost Mattermost Server.