PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6689 Mattermost CVE debrief

CVE-2026-6689 is a medium-severity vulnerability affecting Mattermost, a popular communication platform. The vulnerability has a CVSS score of 4.3 and was published on 2026-06-12. It allows an authenticated user with PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings, making the team publicly joinable or constraining membership via allowed domains.

Vendor
Mattermost
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-18
Advisory published
2026-06-12
Advisory updated
2026-06-18

Who should care

Administrators and users of Mattermost instances, particularly those with custom permission settings, should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The vulnerability occurs because Mattermost fails to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation. This check was only applied on update/patch operations. An authenticated user with PermissionCreateTeam but not PermissionInviteUser can create a team with settings that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patches or updates provided by Mattermost to address this vulnerability.
  • Review and adjust team creation and permission settings to ensure that users can only configure settings they are permitted to change.
  • Monitor team creation and configuration activities for potential abuse.

Evidence notes

The CVE was published on 2026-06-12 with a CVSS score of 4.3 and a medium severity rating. The vulnerability affects Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, and 10.11.x <= 10.11.16.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6689 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6689

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6689 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6689

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.