Mattermost server versions that do not filter invite IDs according to user permissions allow any logged‑in user to supply a leaked invite token and create a new account that is not intended to belong to a specific team. This flaw provides an unauthorized user with the ability to add themselves or others to teams, thereby compromising the integrity and confidentiality of team membership. The weakness is classified as CWE-862, Improper Authorization.

All Mattermost Server releases with versions 11.3.x up to and including 11.3.0, 11.2.x up to and including 11.2.2, and 10.11.x up to and including 10.11.10 are affected. The vendor recommends upgrading to any release newer than these, such as 11.4.0, 11.3.1, 11.2.3, or 10.11.11.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that real‑world exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation does not require elevated privileges beyond a normal user account; an attacker who can access a valid invite ID can directly create an unauthorized account during team creation. Although the risk is moderate, the potential to manipulate team composition can be critical for organizations with strict access controls.