Mattermost Invite Permission Vulnerability in Team Privacy Settings

A vulnerability exists in Mattermost versions 9.11.x prior to 9.11.5, allowing team admins without invitation permissions to invite users. This is achieved by changing the 'allow_open_invite' field after making their team public, thereby bypassing permission restrictions.

Impact

Exploitation of this vulnerability could lead to unauthorized user invitations, allowing invited users to join teams where they would not typically be permitted.

Remediation

Users can upgrade to Mattermost version 10.9.010.5.69.11.1610.8.110.7.310.6.6 to address this vulnerability.