CVE-2026-16453
Received Received - Intake

SAML RelayState Forgery in Mattermost

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Mattermost, Inc.

Description
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-16453
EUVD
EUVD-2026-102745

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Mattermost Mattermost 11.10.0
Mattermost Mattermost 11.7.0
Mattermost Mattermost 11.9.0
Mattermost Mattermost 11.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-472 The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mattermost versions between 11.7.0 and 11.10.0. It allows an authenticated SAML user to bypass team restrictions by forging the team_id or invite_id fields in the SAML RelayState parameter. The system fails to verify the integrity of this parameter, enabling unauthorized access to invite-only teams.

Impact Analysis

An attacker with valid SAML credentials could join restricted teams they are not authorized to access. This could lead to unauthorized data exposure, privilege escalation, or disruption of team operations. The impact is limited to authenticated users but bypasses intended access controls.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data segregation, such as GDPR's data protection principles or HIPAA's access control safeguards. Unauthorized team access may lead to data breaches or improper data handling.

Mitigation Strategies

Update Mattermost to a version that fixes the SAML RelayState integrity check vulnerability. Specifically, upgrade to versions beyond 11.10.0, 11.7.9, 11.9.1, or 11.8.5 depending on your current installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart