Is CVE-2026-91181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91181 being exploited in the wild.

How severe is CVE-2026-91181?

Medium severity, with a CVSS score of 6.5, published 14 September 2026.

Which products and versions are affected?

Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below.

Is there a fix for CVE-2026-91181?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-91181 attacked?

It is attacked over the network.

Am I affected by CVE-2026-91181?

Check whether you run Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91181: Mattermost information disclosure in data retention teams endpoint

CVE-2026-91181 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Mattermost is a team messaging and collaboration platform. A vulnerability in the data retention policy endpoint allows authenticated users with read-only Data Retention Policy permissions to view sensitive team information (invite IDs and email addresses) that should be hidden from them, potentially enabling unauthorized access to private teams.

Technologies: Mattermost Server. Vendors: Mattermost.

Quick answers

Is CVE-2026-91181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91181 being exploited in the wild.
How severe is CVE-2026-91181?: Medium severity, with a CVSS score of 6.5, published 14 September 2026.
Which products and versions are affected?: Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below.
Is there a fix for CVE-2026-91181?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-91181 attacked?: It is attacked over the network.
Am I affected by CVE-2026-91181?: Check whether you run Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The data retention teams endpoint (/api/v4/data_retention/policies/{policy_id}/teams) fails to sanitize Team objects returned to the caller, exposing sensitive fields including invite_id and email addresses. An authenticated user holding only read-only Data Retention Policy permissions can retrieve this endpoint and harvest the private team's invite_id to join the team without proper authorization. The vulnerability is a permission bypass combined with information disclosure; an attacker needs valid API authentication but only minimal read-only privileges. Patches are available in versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.

Affected products

Mattermost Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below

Timeline

2026-09-14: disclosed

References

https://mattermost.com/security-updates

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.