CVE-2026-6689

Analyzed Analyzed - Analysis Complete

Permission Bypass in Mattermost Team Creation Settings

Publication date: 2026-06-12

Last updated on: 2026-06-18

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-18

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-6689

EUVD

EUVD-2026-36501

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost_server	From 10.11.0 (inc) to 10.11.17 (exc)
mattermost	mattermost_server	From 11.5.0 (inc) to 11.5.5 (exc)
mattermost	mattermost_server	From 11.6.0 (inc) to 11.6.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects certain versions of Mattermost where the system fails to enforce the PermissionInviteUser permission during the creation of a team when setting the AllowOpenInvite or AllowedDomains options.

Specifically, the permission check for inviting users was only applied during updates or patches, not during the initial team creation.

As a result, an authenticated user who has permission to create teams (PermissionCreateTeam) but does not have permission to invite users (PermissionInviteUser) can configure team settings related to invitations, such as making the team publicly joinable or restricting membership by allowed domains, which they should not be able to do.

Impact Analysis

This vulnerability can allow an authenticated user without proper invite permissions to configure team invitation settings improperly.

They could make a team publicly joinable via open invite or restrict membership by allowed domains without authorization.

This could lead to unauthorized users joining teams or unintended access control configurations, potentially impacting team security and membership management.

Hi! I’m here to help you understand CVE-2026-6689. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70