CVE-2026-20796 — Time-of-check Time-of-use (TOCTOU) Race Condition in Mattermost Mattermost-server

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition7 documents5 sources
Severity
3.1LOWNVD
EPSS
0.0%
top 98.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Mattermost Mattermost-serverMattermost ServerMattermost
Timeline
PublishedFeb 13
Latest updateFeb 23

Description

Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.6 | Impact: 1.4

Affected Packages3 packages

▶NVDmattermost/mattermost_server10.11.0 — 10.11.10
▶Gogithub.com/mattermost_mattermost-server10.11.0 — 10.11.10+1
▶CVEListV5mattermost/mattermost10.11.0 — 10.11.9

🔴Vulnerability Details

4
OSV
Mattermost doesn't properly validate channel membership at the time of data retrieval in github.com/mattermost/mattermost-server↗2026-02-23
▶
CVEList
Time-of-check time-of-use vulnerability in common teams API↗2026-02-13
▶
GHSA
Mattermost doesn't properly validate channel membership at the time of data retrieval↗2026-02-13
▶
OSV
Mattermost doesn't properly validate channel membership at the time of data retrieval↗2026-02-13
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-20796 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-20796 — LOW severity | cvebase