CVE-2026-91181

Received Received - Intake

Stored XSS in Mattermost via Data Retention Teams Endpoint

Publication date: 2026-09-14

Last updated on: 2026-09-16

Assigner: Mattermost, Inc.

Description

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-16

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-91181

EUVD

EUVD-2026-78160

Affected Vendors & Products

Vendor	Product	Version / Range
mattermost	mattermost	to 11.9.0 (inc)
mattermost	mattermost	to 11.8.4 (inc)
mattermost	mattermost	to 11.7.7 (inc)
mattermost	mattermost	to 10.11.22 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Mattermost versions between 11.9.0 and older, 11.8.4 and older, 11.7.7 and older, and 10.11.22 and older fail to properly sanitize Team objects from the data retention teams endpoint. This flaw allows an authenticated user with read-only Data Retention Policy permission to access a private team's secret invite_id and email address. The attacker can then use this information to join the private team without proper authorization via a specific API endpoint.

Detection Guidance

This vulnerability can be detected by checking Mattermost server logs for unauthorized access attempts to the /api/v4/data_retention/policies/{policy_id}/teams endpoint. Look for GET requests from users with only read-only Data Retention Policy permissions accessing private team data.

Impact Analysis

If you are a Mattermost user with read-only Data Retention Policy permissions, an attacker with the same access level could exploit this to join private teams they are not authorized to access. This could lead to unauthorized access to sensitive team discussions, files, and other confidential information shared within those private teams.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by allowing unauthorized access to private team data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Unauthorized access risks data breaches, leading to legal penalties and reputational damage.

Mitigation Strategies

Update Mattermost to a version that is not affected by this vulnerability. Specifically, upgrade to versions 11.9.1 or later, 11.8.5 or later, 11.7.8 or later, or 10.11.23 or later to resolve the issue.

Hi! I’m here to help you understand CVE-2026-91181. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70