# CVE-2026-91181: Mattermost information disclosure in data retention teams endpoint

Source: https://junglewise.ai/threats/cve-2026-91181-mattermost-information-disclosure-in-data-retention-teams  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91181 · Severity: medium · CVSS 6.5 · Published 2026-09-14

Mattermost is a team messaging and collaboration platform. A vulnerability in the data retention policy endpoint allows authenticated users with read-only Data Retention Policy permissions to view sensitive team information (invite IDs and email addresses) that should be hidden from them, potentially enabling unauthorized access to private teams.

Technologies: [Mattermost Server](https://junglewise.ai/threats/technologies/server-public). Vendors: [Mattermost](https://junglewise.ai/threats/vendors/mattermost).

## Quick answers

**Is CVE-2026-91181 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91181 being exploited in the wild.

**How severe is CVE-2026-91181?** Medium severity, with a CVSS score of 6.5, published 14 September 2026.

**Which products and versions are affected?** Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below.

**Is there a fix for CVE-2026-91181?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91181 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-91181?** Check whether you run Mattermost Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The data retention teams endpoint (/api/v4/data_retention/policies/{policy_id}/teams) fails to sanitize Team objects returned to the caller, exposing sensitive fields including invite_id and email addresses. An authenticated user holding only read-only Data Retention Policy permissions can retrieve this endpoint and harvest the private team's invite_id to join the team without proper authorization. The vulnerability is a permission bypass combined with information disclosure; an attacker needs valid API authentication but only minimal read-only privileges. Patches are available in versions 11.9.1+, 11.8.5+, 11.7.8+, and 10.11.23+.

## Affected products

- Mattermost Mattermost Server 11.9.0 and below, 11.8.4 and below, 11.7.7 and below, 10.11.22 and below

## Timeline

- 2026-09-14: disclosed

## References

- [https://mattermost.com/security-updates](https://mattermost.com/security-updates)

## Related threats

- [Mattermost CSRF via Agents plugin mention reminder validation](https://junglewise.ai/threats/cve-2026-93851-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10)
- [Mattermost denial of service via PDF text extraction memory exhaustion](https://junglewise.ai/threats/cve-2026-93850-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost denial of service in WebSocket msgpack decoder](https://junglewise.ai/threats/cve-2026-93849-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)
- [Mattermost information disclosure in post deletion events](https://junglewise.ai/threats/cve-2026-19621-mattermost-versions-11-10-x-11-10-0-11-7-x-11-7-9-11-9-x-11-9-1)
- [Mattermost authentication token leak in server logs](https://junglewise.ai/threats/cve-2026-19600-mattermost-versions-11-9-x-11-9-1-11-8-x-11-8-5-11-7-x-11-7-10-11)