A vulnerability was found in Mattermost up to 10.11.9/11.2.x. It has been declared as problematic. The affected element is an unknown function of the file /common_teams of the component Channel Membership Handler. Such manipulation leads to time-of-check time-of-use.
This vulnerability is referenced as CVE-2026-20796. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
