CVE-2026-20796
📋 TL;DR
This vulnerability allows deactivated Mattermost users to learn team names they shouldn't have access to through a race condition in the API. It affects Mattermost versions 10.11.x up to 10.11.9. The issue occurs when the system fails to properly validate channel membership during data retrieval.
💻 Affected Systems
- Mattermost
📦 What is this software?
Mattermost Server by Mattermost
⚠️ Risk & Real-World Impact
Worst Case
Deactivated users could discover sensitive team names and organizational structure information, potentially enabling social engineering or targeted attacks.
Likely Case
Deactivated users gain limited information about team names they previously had access to, but cannot access actual team content or messages.
If Mitigated
With proper user deactivation procedures and monitoring, impact is limited to information disclosure of team names only.
🎯 Exploit Status
Requires a deactivated user account and exploitation of a race condition in the /common_teams API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.11.10 or later
Vendor Advisory: https://mattermost.com/security-updates
Restart Required: No
Instructions:
1. Upgrade Mattermost to version 10.11.10 or later. 2. No restart required as this is a hotfix. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Disable deactivated user API access
allImmediately revoke API access for all deactivated users to prevent exploitation.
UPDATE Users SET AuthService = '' WHERE DeleteAt > 0
🧯 If You Can't Patch
- Immediately deactivate and remove all unused user accounts
- Implement network segmentation to restrict API access to deactivated users
🔍 How to Verify
Check if Vulnerable:
Check Mattermost version via System Console > About or run: SELECT Value FROM Systems WHERE Name = 'Version'Check Version:
SELECT Value FROM Systems WHERE Name = 'Version'Verify Fix Applied:
Verify version is 10.11.10 or later and test that deactivated users cannot access /common_teams endpoint.📡 Detection & Monitoring
Log Indicators:
- Multiple rapid API calls to /common_teams from deactivated user accounts
- Unusual access patterns from recently deactivated users
Network Indicators:
- High frequency of GET requests to /api/v4/users/*/teams endpoint
- Traffic from deactivated user sessions
SIEM Query:
source="mattermost" AND (uri_path="/api/v4/users/*/teams" OR uri_path="/common_teams") AND user_status="deactivated"