CVE-2026-6689: Mattermost Permission Bypass in Team Creation

Technical summary

CVE-2026-6689 exploits a logic flaw in Mattermost's permission enforcement layer. The PermissionInviteUser check is applied only during team updates (PATCH operations) but not during initial team creation (POST operations). An attacker holding PermissionCreateTeam can pass allow_open_invite: true or a non-empty allowed_domains array in the POST /api/v4/teams request body to bypass the permission gate. The vulnerability spans versions 11.6.x (≤11.6.1), 11.5.x (≤11.5.4), and 10.11.x (≤10.11.16), indicating a regression or incomplete security control implementation across a wide release window. The underlying root cause is asymmetric permission validation between create and update code paths.

Business impact

This vulnerability allows privilege escalation within a Mattermost deployment. A user with team-creation permissions but without invitation-management permissions can unilaterally control team joinability and domain membership policies. In organizations that rely on Mattermost for internal communication, this enables unauthorized changes to team access controls, potentially exposing sensitive channels to unintended members or locking out legitimate ones. The impact is heightened in multi-tenant or federated deployments where teams represent distinct organizational units. However, the risk is contained to the authenticated user's team configuration authority—there is no data exfiltration or system-wide compromise.

Affected systems

Mattermost Server is affected across multiple recent versions: 11.6.x up to and including 11.6.1, 11.5.x up to and including 11.5.4, and 10.11.x up to and including 10.11.16. Organizations running any of these versions in production are potentially vulnerable if they grant team-creation permissions to users who should not have invitation-control authority. Verify your deployed version via the System Console (Administration → About) and cross-reference against these affected ranges. Notably, the vulnerability spans both recent (11.x) and earlier long-term support (10.11.x) release lines.

Exploitability

Exploitation requires valid Mattermost credentials and at least PermissionCreateTeam on a workspace. No network-level authentication bypass is needed. The attack is straightforward: submit a POST request to /api/v4/teams with allow_open_invite or allowed_domains set, and the permission check will not trigger. The vulnerability is not listed on CISA's KEV catalog, suggesting no evidence of active weaponization in the wild as of the advisory date. However, the ease of exploitation (single API call with no special conditions) means that any insider threat with team-creation privileges poses an immediate risk. The CVSS 3.1 score of 4.3 (MEDIUM) reflects the requirement for authentication and the limited scope (integrity impact only, no confidentiality or availability impact).

Remediation

Upgrade to patched versions immediately. Consult the Mattermost security advisory (MMSA-2026-00655) for specific fixed versions. In the interim, restrict PermissionCreateTeam to users and roles that also hold PermissionInviteUser, or implement organizational policy ensuring that team creators do not modify team access settings post-creation. Monitor team creation and configuration logs for suspicious activity. Organizations unable to patch quickly should review role-based access control (RBAC) assignments to minimize the number of users holding the CreateTeam permission without corresponding invitation privileges.

Patch guidance

Visit the Mattermost security advisories page and reference MMSA-2026-00655 to identify the fixed version for your release line (11.6.x, 11.5.x, or 10.11.x). Mattermost typically provides patches on a regular cadence; upgrade as soon as the patched version is available for your support lifecycle. Test the upgrade in a staging environment first to validate compatibility with custom integrations or plugins. The advisory publication date is 2026-06-12, so fixed builds should be available shortly thereafter. Check your Mattermost subscription portal for automated update notifications.

Detection guidance

Audit team creation API calls (POST /api/v4/teams) in your Mattermost logs and look for requests that include allow_open_invite: true or non-empty allowed_domains values, especially when originating from users without PermissionInviteUser. Configure webhooks or SIEM integrations to alert on team configuration changes that conflict with expected policy. Review team settings in the System Console → Teams section for unexpectedly permissive joinability settings on teams created during the vulnerability window. Correlate recent team creator accounts with their assigned permissions to identify potential exposure.

Why prioritize this

Although assigned a MEDIUM CVSS score, this vulnerability should be treated as a near-term patch candidate because it enables unauthorized delegation of access-control authority to team members. In environments where team structure maps to business function or data classification, misconfiguration of invitation settings can have outsized organizational impact. The wide range of affected versions (10.11.x through 11.6.x) suggests a systemic permission-check oversight rather than an edge case, increasing the likelihood that multiple teams have been affected if the vulnerability has been exploited. The fact that no KEV listing exists does not lower urgency; CISA KEV status reflects active exploitation in the wild, not vulnerability severity.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects: (1) low attack complexity—a simple API call with no race conditions or special preconditions; (2) requirement for authentication (PR:L); (3) no confidentiality or availability impact; (4) low integrity impact limited to team-level settings. The score appropriately penalizes the attack for requiring valid credentials, but does not fully capture the organizational risk of permissive team access in communication-critical infrastructure. Risk context should account for your deployment's role-based access control maturity and the sensitivity of teams in scope.

Frequently asked questions