The vulnerability resides in Mattermost server versions 10.11.x from 10.11.0 to 10.11.9, where the /common_teams endpoint fails to validate channel membership at the time data is retrieved. A deactivated user can exploit a race condition to learn the names of teams they should not be able to see, resulting in unauthorized disclosure of sensitive team information. The weakness corresponds to CWE‑367 and carries a low CVSS score of 3.1.

Sponsors: Mattermost, product: Mattermost server. Affected versions are 10.11.0 through 10.11.9 inclusive; the vendor recommends upgrading to 10.11.10 or higher, or to 11.3.0 or later.

The CVSS base score of 3.1 and an EPSS rate of less than 1% indicate a low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to have a deactivated account that can still call the /common_teams API, then repeatedly invoke the endpoint during the presence of a race condition; based on the description, the attack vector is likely remote API usage by a compromised or malicious deactivated user.