CVE-2026-16453

7.1High

Published 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-472

Impact

Authenticated SAML users can unauthorizedly join any invite-only team by tampering with the RelayState parameter. Attackers only need valid SAML credentials on the target instance.

Root cause

The application fails to verify the integrity and signature of the SAML RelayState POST parameter when processing team_id or invite_id fields.

Affected systems

Mattermost 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Fix & remediation

Upgrade Mattermost to version 11.10.1, 11.9.2, 11.8.6, 11.7.10, or later. If patching immediately is not possible, temporarily restrict SAML team join workflows or audit team memberships for unauthorized joins.

shell

$ mattermost version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727

References

https://mattermost.com/security-updates

Source: nvd.nist.gov/vuln/detail/CVE-2026-16453