CVE-2026-6689
Received Received - Intake
Permission Bypass in Mattermost Team Creation Settings

Publication date: 2026-06-12

Last updated on: 2026-06-12

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-12
Last Modified
2026-06-12
Generated
2026-06-12
AI Q&A
2026-06-12
EPSS Evaluated
N/A
NVD
CVE-2026-6689
EUVD
EUVD-2026-36501
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
mattermost mattermost to 11.6.1 (inc)
mattermost mattermost to 11.5.4 (inc)
mattermost mattermost to 10.11.15 (inc)
mattermost mattermost to 10.11.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects certain versions of Mattermost where the system fails to enforce the PermissionInviteUser permission during the creation of a team when setting the AllowOpenInvite or AllowedDomains options.

Specifically, the permission check for inviting users was only applied during updates or patches, not during the initial team creation.

As a result, an authenticated user who has permission to create teams (PermissionCreateTeam) but does not have permission to invite users (PermissionInviteUser) can configure team settings related to invitations, such as making the team publicly joinable or restricting membership by allowed domains, which they should not be able to do.

Impact Analysis

This vulnerability can allow an authenticated user without proper invite permissions to configure team invitation settings improperly.

They could make a team publicly joinable via open invite or restrict membership by allowed domains without authorization.

This could lead to unauthorized users joining teams or unintended access control configurations, potentially impacting team security and membership management.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6689. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart