The flaw arises because Mattermost fails to validate the email address tied to an invited user when a team or guest invitation token is redeemed. An attacker who is already authenticated and has obtained or forwarded a valid invitation link can use the token to join a team or private channel that the original invitee was not intended to access. This results in unauthorized membership and possible exposure of confidential team communications, files, and restricted channel content.

The vulnerability affects Mattermost releases up to the following versions: 11.10.0 and earlier, 11.9.1 and earlier, 11.8.5 and earlier, and 11.7.9 and earlier. All older releases that share the same invitation logic are also susceptible.

The CVSS score of 5 indicates medium severity, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is via a forwarded or leaked invitation link and requires only that the attacker be authenticated and possess a valid token. Because the flaw allows malicious users to join teams or private channels without consent, it poses a significant confidentiality risk to sensitive team communications.