CVE-2026-18223: Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.10 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.2 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated to Mattermost and must obtain a team or guest invitation link that was forwarded or leaked. Exploitation also requires redeeming an invitation token that was intended for a different email address.
What access could an attacker gain?
A successful attacker can join a team or obtain unauthorized access to private channels through a redeemed team or guest invitation token.
Which releases are affected?
Affected releases are Mattermost 11.10.0, 11.7.9 and earlier within the 11.7.x branch, 11.9.1 and earlier within the 11.9.x branch, and 11.8.5 and earlier within the 11.8.x branch.