CVE-2026-9693EPSS p17.6%

CVE-2026-9693CVE-2026-9693

mattermost / mattermost_server

Description

Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682

Scoring

CVSS 3.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS0.27% probability of exploitation · percentile 17.6% · 2026-10-05T12:00:23Z
Last modified2026-08-19
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.