Description

Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-17T23:16:52.940Z",
  "pubdate": "2026-08-17T23:16:52.940Z",
  "executiveSummary": "Mattermost versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5 contain an authorization and state-management vulnerability involving the team threads API and thread membership records. The vulnerability is classified as an improper access control issue where thread membership associations are persistently orphaned rather than purged when a user departs or is removed from a team context. If the affected user is subsequently re-invited to the target team, the residual thread membership records incorrectly re-grant authorization evaluation privileges over previously inaccessible data. This security flaw enables unauthorized attackers, specifically previously removed users who regain basic team membership, to view sensitive private channel thread root post content and associated metadata via the team threads API endpoint. The risk implication involves the unauthorized disclosure of confidential communications originating from private channels, thereby bypassing intended team and channel boundary restrictions. Exploitation requires a multi-stage prerequisite sequence: initial team membership and participation, subsequent removal or departure from the team, retention of orphaned database state, and eventual re-invitation to the same team to leverage the stale authorization checks.",
  "technicalDetails": "The root cause of this vulnerability lies in the lifecycle management logic governing thread membership records within the application database backend when a user context is severed from a team. Specifically, when a user is removed from a team or voluntarily leaves, the backend operations fail to cascade the deletion or revocation of corresponding thread membership entries associated with private channels inside that team structure. Consequently, these orphaned database records persist indefinitely, maintaining an implicit linkage between the user identity and specific thread identifiers.\nThe vulnerable component resides within the team threads API subsystem and the underlying data access objects responsible for querying and filtering thread accessibility based on membership status. During API execution for team threads, authorization checks validate user access against existing thread membership tables rather than validating active membership permissions against the current team and private channel ACLs in real time. Because the stale thread membership records were never purged during the prior team removal action, the authorization logic improperly treats the re-invited user as an authorized participant in those threads.\nThe attack flow proceeds as follows: First, a user gains legitimate access to a private channel thread within a team. Second, the user is removed from or leaves the team, which should theoretically strip all access to the team's internal assets. Due to the flaw, thread membership data remains intact in the database. Third, the user is later re-invited to the team, restoring baseline team membership. Fourth, the attacker queries the team threads API. Fifth, the API evaluates the stale thread membership records, bypasses the contextual private channel restriction checks, and returns sensitive thread root post content and metadata to the user.\nAffected versions include Mattermost 10.11.x through 10.11.20 and 11.7.x through 11.7.5. Authentication and baseline team membership are required to execute the API request, but unauthorized privilege escalation occurs because the user accesses private channel data without holding valid channel membership or valid continuous team association. The attack surface is exposed over the network via standard application programming interfaces utilized by client applications."
}