Mattermost 11.7.x11.10.x: SAML RelayState Integrity Bypass
CVE-2026-16453 Published on October 16, 2026
Mattermost SAML RelayState forgery allows unauthorized team membership
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.. Mattermost Advisory ID: MMSA-2026-00727
Vulnerability Analysis
CVE-2026-16453 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an Assumed-Immutable Parameter Tampering Vulnerability?
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CVE-2026-16453 has been classified to as an Assumed-Immutable Parameter Tampering vulnerability or weakness.
Products Associated with CVE-2026-16453
Want to know whenever a new CVE is published for MatterMost? stack.watch will email you.
Affected Versions
Mattermost:- Version 11.10.0, <= 11.10.0 is affected.
- Version 11.7.0, <= 11.7.9 is affected.
- Version 11.9.0, <= 11.9.1 is affected.
- Version 11.8.0, <= 11.8.5 is affected.
- Version 11.11.0 is unaffected.
- Version 11.10.1 is unaffected.
- Version 11.7.10 is unaffected.
- Version 11.9.2 is unaffected.
- Version 11.8.6 is unaffected.