A malicious remote team can send crafted membership‑synchronization messages that bypass the authorization checks in Mattermost. By exploiting the failure to restrict team‑level permissions during this process, the attacker can grant a user full access to a private team instead of limiting them to a shared channel. This escalation directly compromises the confidentiality and integrity of all data and communications within the affected team.

Mattermost server releases 11.2.x up to 11.2.2, 10.11.x up to 10.11.10, 11.4.x up to 11.4.0, and 11.3.x up to 11.3.1 are vulnerable whenever they accept membership sync from a remote cluster. All installations of these versions that are configured to sync with external Mattermost clusters are at risk.

The moderate CVSS score of 5.4 indicates a moderate severity, but the EPSS score of less than 1 percent and absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation at present. Exploitation requires control of a trusted remote cluster or the ability to host a malicious cluster that can send crafted sync messages, making the attack scenario relatively constrained but still capable of elevating a user’s privileges from channel‑level to full team‑level.