Executive brief
Mattermost is a team messaging and collaboration platform. A vulnerability in the data retention policy endpoint allows authenticated users with read-only Data Retention Policy permissions to view sensitive team information (invite IDs and email addresses) that should be hidden from them, potentially enabling unauthorized access to private teams.
Technical details
The data retention teams endpoint (/api/v4/data_retention/policies/{policy_id}/teams) fails to sanitize Team objects returned to the caller, exposing sensitive fields including invite_id and email addresses. An authenticated user holding only read-only Data Retention Policy permissions can retrieve this endpoint and harvest the private team's invite_id to join the team without proper authorization. The vulnerability is a permission bypass combined with information disclosure; an attacker needs valid API authentication but only minimal read-only privileges. Patches are available in versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.
Affected products
- Mattermost Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below
Timeline
- 2026-09-14: disclosed