CVE-2026-9693 in Mattermost
Summary
by MITRE • 08/18/2026
Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in Mattermost versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5 represents a critical failure in access control logic related to team membership lifecycle management. Specifically, the application fails to properly clean up thread membership records when a user is removed from or leaves a team. This oversight creates a state inconsistency where residual data persists in the database despite the revocation of explicit permissions associated with that team. The core technical flaw lies in the absence of cascading deletion or invalidation logic for thread-specific metadata and access tokens upon user departure, leaving orphaned records that retain validity under certain conditions.
The operational impact of this vulnerability is significant because it enables a previously removed user who is subsequently re-invited to the same team to bypass intended security boundaries. Upon re-invitation, the system incorrectly associates the user with existing thread memberships that were not properly purged during their previous departure. This allows the re-invited individual to access private channel thread root post content and metadata via the team threads API, which should strictly be restricted to current active members of those specific channels. The attacker does not need to exploit a complex injection or buffer overflow; rather, they leverage the application's own state management logic against itself by exploiting the persistence of stale authorization data.
This issue aligns with CWE-284 Improper Access Control and CWE-613 Insufficient Session Expiration as it involves the improper handling of user permissions over time. The attack vector is classified under MITRE ATT&CK technique T1078 Valid Accounts, specifically involving legitimate account manipulation where an attacker uses valid credentials to access resources they should no longer have permission for due to prior removal from a group or team. The vulnerability highlights a common architectural weakness in collaborative platforms where session state and database records are not synchronized during membership changes, leading to privilege escalation through residual data retention rather than direct code execution flaws.
Mitigation strategies must focus on immediate patching of the affected Mattermost versions to 10.11.21 or later for the 10.x branch and 11.7.6 or later for the 11.x branch, as these releases contain the necessary fixes for thread membership cleanup logic. Administrators should also audit their user access logs to identify any instances where users were removed and re-invited during the vulnerable window, ensuring that no unauthorized data exposure occurred before the patch was applied. Future development cycles must enforce strict referential integrity checks in database operations related to team and channel memberships, ensuring that all dependent records such as thread subscriptions are atomically deleted or invalidated when a user's primary membership is revoked.