Live › vulnerability › CVE-2026-16453
Go to dashboardMattermost fails to verify the integrity of the SAML RelayState POST parameter. An authenticated SAML user can forge the team_id or invite_id fields to join any team, including invite-only teams.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost deployments on the listed affected versions that use SAML single sign-on and have invite-only teams. Installations without SAML login are not described as affected by the sources.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mattermost | vendor | >= 11.7.0, <= 11.7.9; >= 11.8.0, <= 11.8.5; >= 11.9.0, <= 11.9.1; 11.10.0 | 11.7.10, 11.8.6, 11.9.2, 11.10.1, 11.11.0 |
mmctl version / server --version)11.7.0-11.7.9, 11.8.0-11.8.5, 11.9.0-11.9.1 or 11.10.0 AND SAML login is enabled (System Console > Authentication > SAML 2.0)11.11.0, 11.10.1, 11.9.2, 11.8.6 or 11.7.10 (or later on your release line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
This page as .md · .json · in your agent: get_signal("CVE-2026-16453")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.