CVE-2026-91181

Executive Summary

CVE-2026-91181 is an authorization bypass / improper access control vulnerability in Mattermost, an open-source enterprise messaging and collaboration platform. Mattermost versions 11.9.x (<= 11.9.0), 11.8.x (<= 11.8.4), 11.7.x (<= 11.7.7), and 10.11.x (<= 10.11.22) fail to sanitize Team objects returned by the data retention teams endpoint, allowing an authenticated user who holds only the read-only Data Retention Policy permission to retrieve a private team's invite_id and email, then use that data to join the private team without authorization. The vulnerability is rated CVSS 6.5 (Medium), is not currently in CISA KEV, and no public PoC or exploit code is available.

Technical Analysis

The flaw is classified as CWE-863 (Incorrect Authorization) and is rooted in an object-level data exposure issue within Mattermost's data retention API. According to the NVD description, the endpoint GET /api/v4/data_retention/policies/{policy_id}/teams returns Team objects that are not properly sanitized before being returned to the caller.

Mattermost Team objects contain sensitive fields, including invite_id (a secret token used to construct invite links) and email (an associated team contact address). Under normal authorization design, these fields should only be exposed to users who possess the appropriate team administration or membership permissions. The vulnerable endpoint, however, discloses these fields to any authenticated user holding only the read-only Data Retention Policy permission — a low-privilege, administrative-but-read-only capability that is intended solely to view retention policy metadata and associated team lists for compliance purposes.

The core defect is a missing or insufficient field-level sanitization / response filtering step on the server side. Because the endpoint serializes full Team objects rather than a redacted projection, the invite_id and email fields leak to the caller. The attacker then uses the leaked invite_id (a bearer-style secret embedded in team invite links) to join the targeted private team, bypassing the intended invitation workflow and authorization checks.

Key characteristics:

• Attack vector: Network (AV:N) — the endpoint is HTTP-accessible.
• Attack complexity: Low (AC:L) — no special conditions beyond holding the permission.
• Privileges required: High (PR:H) — the attacker must be authenticated and hold the Data Retention Policy read permission.
• User interaction: None (UI:N).
• Scope: Unchanged (S:U).
• Confidentiality impact: High (C:H) — private team invite_id and email are disclosed.
• Integrity impact: High (I:H) — unauthorized membership in a private team (unauthorized write to team membership state).
• Availability impact: None (A:N).

The vulnerability class is improper access control / broken object-level authorization combined with sensitive data exposure at the API serialization layer. Because the affected endpoint is a legitimate, documented API path, exploitation does not require payload injection — it requires only a valid authenticated session with the correct (but insufficient) permission and knowledge of a target policy_id.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the data provided in the NVD description.

1) Reconnaissance / target identification An attacker obtains authenticated access to a Mattermost instance (either as a legitimate low-privilege user provisioned with the read-only Data Retention Policy permission, or by compromising an account that holds it). The attacker identifies the API base path /api/v4/data_retention/policies/{policy_id}/teams and enumerates or obtains a valid policy_id for a data retention policy that is associated with the target private team.

2) Triggering the flaw The attacker issues an authenticated HTTP GET request to /api/v4/data_retention/policies/{policy_id}/teams using their session token. Because the server fails to sanitize the returned Team objects, the response includes sensitive fields — specifically the private team's invite_id and email — for teams the attacker is not a member of and should not be able to inspect.

3) Payload / execution method This is a non-injection exploitation class. The "payload" is simply the crafted, authenticated GET request to the vulnerable endpoint. From the response, the attacker extracts the invite_id value and constructs the standard Mattermost team invitation/join flow using the leaked secret invite identifier (the same mechanism used by normal invite links). No exploit code, shellcode, or injection payload is required; the vulnerability is exploited purely through legitimate API calls carrying a valid session.

4) Post-exploitation impact Using the harvested invite_id, the attacker joins the private team without authorization. This grants them read access to that team's channels, messages, and membership — potentially exposing confidential business communications, credentials shared in chat, files, and integrations. The leaked team email may additionally be used for social engineering or as a secondary identifier.

Impact Assessment

• Confidentiality (High): Disclosure of private team secrets (invite_id, email) and, subsequently, the private team's content after unauthorized joining.
• Integrity (High): The attacker alters the private team's membership state by joining without authorization — a state-changing action against a resource they should not control.
• Availability (None): No denial-of-service component is described.
• Scope: Unchanged — impact remains within the Mattermost authorization/security boundary.
• Blast radius: Any Mattermost deployment running the affected version ranges (11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22) where a data retention policy is configured and at least one user holds the read-only Data Retention Policy permission. The attack is constrained by the PR:H requirement; the effective population of attackers is limited to authenticated users holding that specific permission (or attackers who have compromised such an account).
• Business impact: Exposure of confidential internal communications and potential lateral movement into restricted project or executive channels. Regulatory and compliance implications if private team data includes regulated information. EPSS is low (0.00227, ~13.5th percentile), indicating low observed exploitation likelihood at this time, and the CVE is not in CISA KEV. The 6.5 score reflects meaningful confidentiality/integrity impact moderated by the high privilege requirement.

Detection Guidance

Sigma Rule

title: Mattermost Data Retention Teams Endpoint Access by Non-Admin
id: 3f9b1e2a-7c4d-4a11-9e8f-1c2d5b6a7f9e
status: experimental
description: Detects authenticated access to the Mattermost data retention policies teams endpoint which may indicate CVE-2026-91181 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91181
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: mattermost
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|contains: '/api/v4/data_retention/policies/' 
    cs-uri-stem|endswith: '/teams'
  condition: selection_method and selection_uri
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
falsepositives:
  - Legitimate administrators performing data retention policy review
level: medium

YARA Rule

rule CVE_2026_91181_Mattermost_DataRetention_Teams
{
    meta:
        author = "valtersit.com"
        description = "Detects requests/exposure patterns tied to Mattermost data retention teams endpoint (CVE-2026-91181)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91181"
        date = "2026-01-01"
    strings:
        $api = "/api/v4/data_retention/policies/"
        $teams = "/teams"
        $invite = "invite_id"
        $email = "email"
    condition:
        $api and $teams and ( $invite or $email )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91181 Mattermost Data Retention Teams Endpoint Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v4/data_retention/policies/"; http.uri; content:"/teams"; distance:0; classtype:attempted-recon; sid:202691181; rev:1; reference:cve,2026-91181;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method == "GET" and
       stringContains(http.request.path, "/api/v4/data_retention/policies/") and
       stringEndsWith(http.request.path, "/teams")]

Splunk SPL Query

index=web OR index=mattermost sourcetype=access_combined OR sourcetype=mattermost:api
| search method=GET uri_path="/api/v4/data_retention/policies/*/teams"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="mattermost,web,">
  <rule id="100911" level="8">
    <if_sid>31100</if_sid>
    <url>/api/v4/data_retention/policies/</url>
    <regex type="pcre2">GET\s+/api/v4/data_retention/policies/[^/]+/teams</regex>
    <description>Mattermost data retention teams endpoint accessed - possible CVE-2026-91181 exploitation attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround was provided in the supplied intelligence data. Refer to Mattermost Advisory ID MMSA-2026-00702 for authoritative remediation guidance.

1. Immediate mitigations

   • Restrict the read-only Data Retention Policy permission to the smallest possible set of trusted administrators; review and revoke it from any account that does not strictly require it.
   • Where feasible, block or monitor access to /api/v4/data_retention/policies/{policy_id}/teams at the reverse proxy/WAF for non-administrative roles.
   • If private teams are sensitive, temporarily disable data retention policies or remove team associations until a fix is available.
   • Rotate or regenerate team invitation secrets / invite links if exposure is suspected.

2. Patch / upgrade steps

   • Monitor Mattermost Advisory MMSA-2026-00702 and the Mattermost security releases page for the fixed build; upgrade to the first patched release in your supported branch once released.
   • No fixed version is confirmed by the provided data, so do not assume any currently listed version is safe.

3. Long-term hardening

   • Enforce least privilege on all administrative and read-only admin permissions; audit who can view retention data.
   • Implement response-field sanitization (allow-list projections) on all API serialization paths to prevent leaking secret fields such as invite_id.
   • Add monitoring/alerting on the vulnerable endpoint and rotate invitation secrets on any confirmed exposure.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91181
• Mattermost Advisory ID: MMSA-2026-00702 (vendor advisory)
• Mattermost Security Advisories: https://mattermost.com/security-updates/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not currently listed)

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template were identified in the provided intelligence data.