Email Validation Flaw in Mattermost Team and Guest Invitation Process
CVE-2026-18223

5MEDIUM

Key Information:

Vendor

Mattermost
Status
Mattermost
Vendor
CVE Published:
16 October 2026

What is CVE-2026-18223?

Mattermost applications have a vulnerability in the invitation token process that fails to properly validate the email addresses of invited recipients. This oversight allows an authenticated attacker to exploit forwarded or leaked invitation links, potentially granting unauthorized access to private channels and teams. Users should be aware of these risks, especially when using versions 11.10.x up to 11.10.0, 11.7.x up to 11.7.9, 11.9.x up to 11.9.1, and 11.8.x up to 11.8.5. For more details, refer to the Mattermost Advisory MMSA-2026-00747.

Affected Version(s)

Mattermost 11.10.0

Mattermost 11.7.0 <= 11.7.9

Mattermost 11.9.0 <= 11.9.1

References

https://mattermost.com/security-updates
vendor-advisory

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CERT PL
.