A vulnerability in Mattermost allows authenticated users to bypass team membership restrictions, posing a significant risk to internal data confidentiality and access control integrity.

This is a missing authorization flaw (CWE-862) where the application fails to verify if a user possesses the required permissions to join a team via an original invite token. An authenticated attacker can exploit this by manipulating the RelayState parameter to gain unauthorized entry into restricted teams.

The ability for unauthorized users to join restricted teams directly compromises organizational data confidentiality and operational security. This flaw facilitates lateral movement within the application, potentially exposing sensitive communications and internal project data to unauthorized personnel. Given the CVSS score of 8.1, this is a high-severity issue that requires immediate attention to prevent unauthorized data access.

Immediate Action: Update Mattermost instances to versions 10.12.0, 10.11.2, 10.10.3, or 10.5.11 immediately to apply the necessary authorization checks.

Proactive Monitoring: Review system and audit logs for unusual team join events or unauthorized access patterns involving the RelayState parameter.

Compensating Controls: Ensure that strict network-level access controls and identity provider policies are enforced to limit the impact of potential unauthorized team access while the update is being deployed.

Public Exploit Available: Unknown

This vulnerability represents a significant breakdown in authorization logic that could lead to unauthorized information disclosure within the Mattermost environment. Organizations should prioritize updating to the patched versions listed above to ensure that team membership remains restricted as intended. Failure to patch may result in unauthorized access to sensitive team channels and internal organizational data.