CVE-2026-16453High· 7.1▾ TwilightMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-on…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93846Low· 3.8Team admin can escalate a team member's permissions via the team member roles endpoint
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
CVE-2026-93850Medium· 6.5Unbounded memory consumption during PDF text extraction
CVE-2026-93848Low· 2.7Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
CVE-2026-93849Medium· 6.5Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames
CVE-2026-116516Medium· 6.5Insufficient length validation when parsing Zoom chat transcriptions