Volerion logoVolerion
Volerion logoVolerion

Mattermost Team Invite ID Exposure Vulnerability for Admins

Vulnerability

A vulnerability exists in Mattermost versions 10.8.x through 10.8.3, 10.5.x through 10.5.8, 9.11.x through 9.11.17, and 10.9.x through 10.9.2. The issue arises in the POST /api/v4/teams/:teamId/restore endpoint, where the team invite ID is not properly sanitized. This flaw allows a team admin without member invite privileges to retrieve the team's invite ID.

Impact

Exploitation of this vulnerability could lead to unauthorized access to team invite IDs, potentially allowing for misuse of invite privileges.

Remediation

Users can upgrade to Mattermost versions 10.11.2, 10.5.10, 9.11.18, or 10.9.5 to address this vulnerability.

Added: Aug 21, 2025, 8:20 AM
Updated: Aug 21, 2025, 8:20 AM

Vulnerability Rating

Custom Algorithm
spread
3.1
impact
0.0
exploitability
5.2
remediation
7.7
relevance
0.4
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.