Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-13 | 1 | Disclosure1 |
| 2026-02-14 | 1 | General1 |
CVE-2026-20796 Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names … https://www.cve.org/CVERecord?id=CVE-2026-20796
Post summary
The text briefly announces CVE-2026-20796 in Mattermost, noting that a deactivated user can discover team names due to improper channel membership validation.
CVE-2026-20796: Ghost in the Machine: Exploiting TOCTOU in Mattermost A deep dive into a subtle Time-of-Check Time-of-Use (TOCTOU) race condition within Mattermost Server's API. This analysis explores how the disconnect between authorization validatio... https://cvereports.com/reports/CVE-2026-20796
Post summary
The article provides a technical analysis of a TOCTOU race condition in Mattermost Server’s API, but offers no PoC, exploit code, active exploitation evidence, patch, or false‑positive claim.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mattermost | mattermost_server | - | - | - |