Live › vulnerability › CVE-2026-18223
Go to dashboardMattermost fails to check that the signed-in user's email matches the invited recipient when redeeming team and guest invitation tokens. An authenticated user holding a forwarded or leaked invite link can join a team or reach private channels they were not invited to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Mattermost servers on the affected 11.7, 11.8, 11.9 and 11.10 release ranges that issue team or guest invitations. The attacker needs a valid Mattermost account, so servers with open self-registration or many users are more exposed. Installs on other versions, or instances that do not use invitations, are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
11.10.1 or later for 11.10.x, 11.7.10 or later for 11.7.x, 11.9.2 or later for 11.9.x, 11.8.6 or later for 11.8.x (inferred from the affected ranges; confirm against MMSA-2026-00747)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
This page as .md · .json · in your agent: get_signal("CVE-2026-18223")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.