Threats tagged 'ghsa-w86c-vmwh-pppx'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.4%	CVE-2026-91181Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams Medium6.5EPSS 0.4%2026-09-15GCVE DatabaseCVE-2026-91181 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret invite_id and email, and use it to join the team without authorization, via GET /api/v4/data_retention/policies/{policy_id}/teams.. Mattermost Advisory ID: MMSA-2026-00702 EPSS 0.4%Vulnerability CWE-863 #ghsa-w86c-vmwh-pppx	GCVE Database	2026-09-15

Page 1 of 1