CVE-2026-9693: Mattermost Server

Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private channel thread root post content and metadata via the team threads API.. Mattermost Advisory ID: MMSA-2026-00682

Affected products

• Mattermost Mattermost Server: from 10.11.0, before 10.11.21 (fixed in 10.11.21); from 11.7.0, before 11.7.6 (fixed in 11.7.6)

Published 2026-08-17. Last modified 2026-08-19.