3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-20796

CVE-2026-20796: Time-of-check time-of-use vulnerability in common teams API

Mattermost versions 10.11.x <= 10.11.9 fail to properly validate channel membership at the time of data retrieval which allows a deactivated user to learn team names they should not have access to via a race condition in the /common_teams API endpoint.. Mattermost Advisory ID: MMSA-2025-00549

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-20796

CVE-2026-20796:

3.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/mattermost/mattermost-server	go	>= 10.11.0, <= 10.11.9	10.11.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the /common_teams API endpoint, which did not properly validate channel membership at the time of data retrieval. This allowed a deactivated user to exploit a race condition and access team names they were no longer authorized to see. The analysis of the patch reveals two key functions involved in this vulnerability.

The first is api4.getGroupMessageMembersCommonTeams in server/channels/api4/channel.go, which serves as the entry point for the API request. This function was calling the application logic without ensuring the user's current status was checked.

The second, and more critical, function is app.App.GetGroupMessageMembersCommonTeams in server/channels/app/channel.go. This function contained the flawed logic that fetched common teams for a channel's members without verifying if the user making the request was still an active member. The vulnerability was a classic Time-of-check Time-of-use (TOCTOU) problem, where the check for user validity and the actual data retrieval were not atomic.

The patch addresses this by introducing a new function, GetGroupMessageMembersCommonTeamsAsUser, which explicitly passes the requesting user's ID. The core logic was moved to a new private function, getGroupMessageMembersCommonTeams, which now includes a crucial check to ensure the requesting user is an active member of the channel before proceeding to fetch and return the list of common teams. If the user is not an active member, it returns an empty list, effectively closing the information leak.

Vulnerable functions

api4.getGroupMessageMembersCommonTeams

server/channels/api4/channel.go

This is the API handler for the /common_teams endpoint. It was calling the vulnerable GetGroupMessageMembersCommonTeams function without proper user validation. The patch changes this to call GetGroupMessageMembersCommonTeamsAsUser, which performs the necessary checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.