An authentication check that should ensure a user possesses the PermissionInviteUser authority is omitted when a team is created with AllowOpenInvite or AllowedDomains enabled. Consequently, an authenticated user who can create a team but does not hold invitation‑management privileges can configure the new team as publicly joinable or restrict it to specific domains. This empowerment permits the user to effectively alter the team’s access controls beyond their granted rights, potentially exposing sensitive channels or undermining security boundaries. The flaw is a missing authorization check (CWE‑862).

Mattermost users running older releases are affected. The vulnerability exists in Mattermost community and enterprise editions for the following ranges: version 11.6.0 – 11.6.1, 11.5.0 – 11.5.4, 10.11.0 – 10.11.15 and 10.11.0 – 10.11.16. Any deployment that has not applied the latest patch releases is therefore susceptible.

The CVSS score of 4.3 classifies this as a moderate severity issue. Exploitation requires the attacker to be an authenticated user with PermissionCreateTeam; no additional privileges or network exposure are needed. Because the EPSS score is not available, it cannot be used to gauge likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can gain unauthorized configuration power via standard API calls or web UI when creating a new team. The risk is limited to privilege escalation within the Mattermost instance, but it can enable broader lateral movement if unrestricted team invites are enabled.