CVE-2026-18223
mediumMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeem…
Vendor / product: Mattermost — mattermost server
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
CVSS
5.0
5.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N Severity source: NVD CVSS v3.1 (responsibledisclosure@mattermost.com)
Timeline (UTC)
Published: 2026-10-16 08:17
Modified: 2026-10-29 18:08
NVD status: Analyzed
Last synced 5 days ago
Verified against the source API 2026-10-30 08:34 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
mattermost / mattermost_server ≥11.7.0 <11.7.10, ≥11.8.0 <11.8.6, ≥11.9.0 <11.9.2, 11.10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://mattermost.com/security-updates
References
- https://mattermost.com/security-updates responsibledisclosure@mattermost.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-30 08:34 UTC · record ↗