CVE-2026-6689

MediumCVSS 4.3/10Last modified Jun 18, 2026

Description

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update/patch), which allows an authenticated user holding PermissionCreateTeam but not PermissionInviteUser on the resulting team to configure invite-controlled team settings (make the team publicly joinable via open invite and/or constrain membership via allowed domains) that they are not permitted to set on an existing team via POST /api/v4/teams with allow_open_invite: true and/or a non-empty allowed_domains in the request body.. Mattermost Advisory ID: MMSA-2026-00655

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2026
Last modified: Jun 18, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-668909.6The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.CVE-2026-668979.9A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launchi CVE-2026-668989.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When i CVE-2026-66907.2The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in al CVE-2026-669017.5Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the CVE-2026-669029.8Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an ungated system call. The Plug CVE-2026-669069.1Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.CVE-2026-669077.5Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9 CVE-2026-669087.5Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.CVE-2026-669099.8Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictio CVE-2026-66917.8The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overfl CVE-2026-669136.9Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a