CVE-2026-16453: Mattermost SAML RelayState forgery allows unauthorized team membership
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the teamid or inviteid fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0Patch MMSA-2026-00727
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SAML user can exploit it. The issue affects deployments where Mattermost uses SAML authentication.
What access could an attacker gain?
An attacker can forge the team_id or invite_id fields in the SAML RelayState POST parameter to join any team, including invite-only teams. This can expose them to the content and access available to members of the targeted team.
Which releases are affected?
Affected releases are Mattermost 11.10.0 and earlier in the 11.10.x line, 11.7.9 and earlier in the 11.7.x line, 11.9.1 and earlier in the 11.9.x line, and 11.8.5 and earlier in the 11.8.x line.