{"id":"GHSA-c28q-m4gf-vg4q","summary":"Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation","details":"Mattermost versions 11.6.x \u003c= 11.6.1, 11.5.x \u003c= 11.5.4, 10.11.x \u003c= 10.11.15, 10.11.x \u003c= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655","aliases":["CVE-2026-6689","GO-2026-6283"],"modified":"2026-08-25T20:26:12.753141744Z","published":"2026-06-12T18:31:59Z","database_specific":{"cwe_ids":["CWE-862"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-24T21:35:43Z","nvd_published_at":"2026-06-12T17:16:27Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6689"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/pull/36402"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/pull/36384"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/pull/36383"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/pull/36375"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/pull/36188"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/977c791e5b54bc14fdb96a2b3dacc85da5d8c623"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/7d6816abdfd170169f717aea43c5716a1f9ef6b0"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/479fc42d0ec6da48e76b59608233d90bfc69769d"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/3a96344214b1a84df70d97052d46b6f2b40b0caa"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/commit/2dea05864024b3254fb28c5ed679592e2b7cd672"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/releases/tag/v10.11.16"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/releases/tag/v11.5.5"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/releases/tag/v11.6.2"},{"type":"WEB","url":"https://github.com/mattermost/mattermost/releases/tag/v11.7.0"},{"type":"WEB","url":"https://mattermost.com/security-updates"},{"type":"PACKAGE","url":"https://github.com/mattermost/mattermost"}],"affected":[{"package":{"name":"github.com/mattermost/mattermost-server","ecosystem":"Go","purl":"pkg:golang/github.com/mattermost/mattermost-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"11.6.0"},{"fixed":"11.6.1"}]}],"versions":["11.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c28q-m4gf-vg4q/GHSA-c28q-m4gf-vg4q.json"}},{"package":{"name":"github.com/mattermost/mattermost-server","ecosystem":"Go","purl":"pkg:golang/github.com/mattermost/mattermost-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"11.5.0"},{"fixed":"11.5.5"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 11.5.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c28q-m4gf-vg4q/GHSA-c28q-m4gf-vg4q.json"}},{"package":{"name":"github.com/mattermost/mattermost-server","ecosystem":"Go","purl":"pkg:golang/github.com/mattermost/mattermost-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"10.11.0"},{"fixed":"10.11.17"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 10.11.15","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c28q-m4gf-vg4q/GHSA-c28q-m4gf-vg4q.json"}},{"package":{"name":"github.com/mattermost/mattermost/server/v8","ecosystem":"Go","purl":"pkg:golang/github.com/mattermost/mattermost/server/v8"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0-20250731163400-5b955468ea1e"},{"fixed":"8.0.0-20260501144115-7d6816abdfd1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-c28q-m4gf-vg4q/GHSA-c28q-m4gf-vg4q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}]}