CVE-2026-6689

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.6.0 through 11.6.1 Mattermost versions 11.5.0 through 11.5.4 Mattermost versions 10.11.0 through 10.11.16

Description An issue exists where the system fails to enforce the PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the creation of a team. This occurs because the permission check was only applied during update or patch operations. Consequently, an authenticated user with PermissionCreateTeam but without PermissionInviteUser can configure invite-controlled settings, such as making a team publicly joinable via open invite or constraining membership through allowed domains. This is achievable via the 'POST /api/v4/teams' endpoint by including allow open invite: true and/or a non-empty allowed domains in the request body.

Recommendations Update Mattermost versions 11.6.0 through 11.6.1 to a version later than 11.6.1. Update Mattermost versions 11.5.0 through 11.5.4 to a version later than 11.5.4. Update Mattermost versions 10.11.0 through 10.11.16 to a version later than 10.11.16.