Mattermost 11.x versions up to certain patch levels do not validate the RelayState POST parameter when using SAML authentication. An attacker who already has a SAML‑authenticated session can craft a POST request that manipulates the RelayState to include a target team ID or invite ID, thereby causing the system to add the user to that team. This flaw permits an authenticated user to be added as a member of any team, including invite‑only teams, without the team's invitation process or approval steps, resulting in unauthorized access to team data.

The affected product is Mattermost, specifically versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5. All releases below the specified patch versions remain vulnerable.

The CVSS base score of 7.1 indicates considerable impact. EPSS score is <1%, indicating a very low but nonzero likelihood of exploitation. An authentic user of a SAML‑enabled Mattermost instance can readily abuse the flaw by forging a RelayState. It is not listed in CISA’s KEV catalog. Exploitation requires a valid SAML session; once the RelayState is manipulated, the platform accepts the request and adds the actor to the target team.