CVE-2026-16453

Name of the Vulnerable Software and Affected Versions Mattermost version 11.10.0 Mattermost versions 11.7.x through 11.7.9 Mattermost versions 11.9.x through 11.9.1 Mattermost versions 11.8.x through 11.8.5

Description An issue exists where the software fails to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including those restricted to invites, by forging the team id or invite id fields within the RelayState.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.