Mattermost Team Settings Invite Permission Bypass Vulnerability

A vulnerability exists in Mattermost versions 10.11.x prior to 10.11.9, where the application fails to properly enforce invite permissions when team settings are updated. This flaw allows team administrators without the necessary permissions to circumvent restrictions and add users to their team via API requests.

Impact

Exploitation of this vulnerability could lead to unauthorized users being added to teams, potentially allowing them access to sensitive information or discussions.

Remediation

Users can upgrade to Mattermost version 10.11.10 or later to address this vulnerability.