CVE-2026-91181: Data Retention Teams Endpoint Leaks Private Team Invite ID
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret inviteid and email, and use it to join the team without authorization, via GET /api/v4/dataretention/policies/{policyid}/teams.. Mattermost Advisory ID: MMSA-2026-00702
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.10.0 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.9.1 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.8.5 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.7.8 - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.11.23 - Compensating control
Review and restrict access to the Mattermost endpoint GET /api/v4/data_retention/policies/{policy_id}/teams to prevent authenticated read-only Data Retention Policy users from obtaining private teams' invite_id and email until the service is updated (MMSA-2026-00702).
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Mattermost user who has the read-only Data Retention Policy permission can exploit it. The exposed data concerns private teams returned by the data retention teams API endpoint.
What does an attacker need to do to gain unauthorized access to a private team?
The attacker can request GET /api/v4/data_retention/policies/{policy_id}/teams to obtain a private team's invite_id and email. They can then use the leaked invite information to join that private team without authorization.
Which Mattermost versions are affected?
Affected releases are Mattermost 11.9.0 and earlier in the 11.9.x line, 11.8.4 and earlier in 11.8.x, 11.7.7 and earlier in 11.7.x, and 10.11.22 and earlier in 10.11.x.
How can an organization determine whether a user may be exposed to this issue?
Review which authenticated users hold the read-only Data Retention Policy permission and whether they can access the data retention teams endpoint. Those users may be able to retrieve invite IDs and email data for private teams associated with data retention policies.