CVE-2026-9693: 
Mattermost Desktop App vulnerability analysis and mitigation

CVE-2026-9693 is a data disclosure vulnerability in Mattermost Server caused by incomplete cleanup of thread membership records when users are removed from or leave a team. Affected versions include Mattermost Server 10.11.0–10.11.20 and 11.7.0–11.7.5. When a previously removed user is later re-invited to the team, stale thread membership records allow them to view private channel thread root post content and metadata via the team threads API. It was published on August 17, 2026, with patches released shortly after. The vulnerability carries a CVSS v3.1 base score of 3.5 (Low) (GitHub Advisory, Mattermost Security).

The root cause is classified as CWE-459 (Incomplete Cleanup): Mattermost fails to purge thread membership records from its database when a user is removed from or voluntarily leaves a team. These orphaned records persist and are not invalidated upon re-invitation, meaning the re-invited user inherits their prior thread membership state. Exploitation requires the attacker to be an authenticated, low-privileged user who was previously a team member, was removed, and was subsequently re-invited — at which point they can query the team threads API to retrieve private channel thread root post content and metadata they should no longer have access to. No public proof-of-concept exploit code has been identified (GitHub Advisory, Mattermost Security).

Successful exploitation results in unauthorized disclosure of private channel thread root post content and associated metadata to a re-invited user who should not have access to those threads. The impact is limited to confidentiality (low), with no integrity or availability consequences. The scope is constrained to the affected Mattermost instance, and lateral movement potential is minimal; however, exposure of private channel content could reveal sensitive organizational communications (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept for CVE-2026-9693. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction (re-invitation to the team), limiting its practical exploitability. The EPSS score is approximately 0.156%, indicating a low probability of exploitation in the near term (GitHub Advisory, Mattermost Security).

1. Identify target: An attacker must be a former member of a Mattermost team who was previously removed or left, and who had prior access to threads in private channels within that team.
2. Re-join the team: The attacker is re-invited to the same Mattermost team by an administrator or team manager.
3. Query the team threads API: After re-joining, the attacker sends authenticated API requests to the team threads endpoint (e.g., GET /api/v4/users/{user_id}/teams/{team_id}/threads) using their valid session token.
4. Access stale thread records: Due to the incomplete cleanup of thread membership records, the API returns private channel thread root post content and metadata from threads the attacker was previously a member of, even if they no longer have legitimate access to those private channels (GitHub Advisory).

• Logs: Mattermost server logs showing API requests to /api/v4/users/{user_id}/teams/{team_id}/threads from users who were recently re-added to a team, particularly if those users are not current members of the private channels whose thread content is returned.
• Audit Logs: Team membership events showing a user removed and subsequently re-invited within a short timeframe, followed by thread API activity.
• Database: Presence of ThreadMembership records in the Mattermost database for users who are no longer active members of the associated private channels.

Mattermost has released patched versions addressing this vulnerability: upgrade to 10.11.21 or later for the 10.11.x branch, and 11.7.6 or later (or 11.9.0+) for the 11.7.x branch. As a workaround, administrators should audit team membership changes — particularly for users who have been removed and re-invited — and verify they only have access to appropriate channels. Restricting thread API access to users with current valid channel membership is also recommended where feasible (Mattermost Security, GitHub Advisory).