CVE-2026-9693

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.20 Mattermost versions 11.7.0 through 11.7.5

Description The software fails to remove thread membership records when a user leaves or is removed from a team. This allows a user who is subsequently re-invited to the team to access private channel thread root post content and metadata through the team threads API.

Recommendations Update Mattermost versions 10.11.0 through 10.11.20 to a version newer than 10.11.20. Update Mattermost versions 11.7.0 through 11.7.5 to a version newer than 11.7.5.