Mattermost Team Join Permission Vulnerability via OAuth State Manipulation

A vulnerability exists in Mattermost versions 10.11.x through 10.11.1, 10.10.x through 10.10.2, and 10.5.x through 10.5.10. These versions fail to properly verify whether a user has the necessary permissions to join a team using an original invite token. This flaw allows any user to join any team on a Mattermost server, bypassing existing restrictions, by manipulating the OAuth state.

Impact

Exploitation of this vulnerability allows users to join teams without proper authorization, potentially leading to unauthorized access to team resources and communications.

Remediation

Users can upgrade to Mattermost version 11.0.0 or 10.12.0, depending on their current version, to address this vulnerability.