From d00e9d48d3ae1faab2d00613652e65071bfcc978 Mon Sep 17 00:00:00 2001
From: Mattermost Build <build@mattermost.com>
Date: Tue, 2 Jun 2026 20:24:05 +0200
Subject: [PATCH] Automated cherry pick of #36640 (#36792)

Automatic Merge
---
 server/channels/api4/scheme.go      |  2 +
 server/channels/api4/scheme_test.go | 59 +++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/server/channels/api4/scheme.go b/server/channels/api4/scheme.go
index 8ba79589f9..f4be0a37c4 100644
--- a/server/channels/api4/scheme.go
+++ b/server/channels/api4/scheme.go
@@ -137,6 +137,8 @@ func getTeamsForScheme(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	c.App.SanitizeTeams(*c.AppContext.Session(), teams)
+
 	js, err := json.Marshal(teams)
 	if err != nil {
 		c.Err = model.NewAppError("getTeamsForScheme", "api.marshal_error", nil, "", http.StatusInternalServerError).Wrap(err)
diff --git a/server/channels/api4/scheme_test.go b/server/channels/api4/scheme_test.go
index d9f48a9703..0dbba33f52 100644
--- a/server/channels/api4/scheme_test.go
+++ b/server/channels/api4/scheme_test.go
@@ -428,6 +428,65 @@ func TestGetTeamsForScheme(t *testing.T) {
 	CheckNotImplementedStatus(t, ri6)
 }
 
+func TestGetTeamsForScheme_SanitizesPrivilegedFieldsForUserManager(t *testing.T) {
+	mainHelper.Parallel(t)
+	th := Setup(t)
+
+	th.App.Srv().SetLicense(model.NewTestLicense("custom_permissions_schemes"))
+
+	err := th.App.SetPhase2PermissionsMigrationStatus(true)
+	require.NoError(t, err)
+
+	scheme := &model.Scheme{
+		DisplayName: model.NewId(),
+		Name:        model.NewId(),
+		Description: model.NewId(),
+		Scope:       model.SchemeScopeTeam,
+	}
+	scheme, _, err = th.SystemAdminClient.CreateScheme(context.Background(), scheme)
+	require.NoError(t, err)
+
+	knownInviteID := model.NewId()
+	knownEmail := th.GenerateTestEmail()
+
+	privateTeam := &model.Team{
+		Name:        GenerateTestTeamName(),
+		DisplayName: "Private Scheme Team",
+		Type:        model.TeamInvite,
+		InviteId:    knownInviteID,
+		Email:       knownEmail,
+	}
+	privateTeam, err = th.App.Srv().Store().Team().Save(privateTeam)
+	require.NoError(t, err)
+	require.Equal(t, knownInviteID, privateTeam.InviteId)
+	require.Equal(t, knownEmail, privateTeam.Email)
+
+	privateTeam.SchemeId = &scheme.Id
+	privateTeam, err = th.App.Srv().Store().Team().Update(privateTeam)
+	require.NoError(t, err)
+	require.Equal(t, knownInviteID, privateTeam.InviteId)
+	require.Equal(t, knownEmail, privateTeam.Email)
+
+	th.LoginSystemManager()
+
+	t.Run("system manager response is sanitized", func(t *testing.T) {
+		teams, _, err := th.SystemManagerClient.GetTeamsForScheme(context.Background(), scheme.Id, 0, 100)
+		require.NoError(t, err)
+		require.Len(t, teams, 1)
+		assert.Equal(t, privateTeam.Id, teams[0].Id)
+		assert.Empty(t, teams[0].InviteId)
+	})
+
+	t.Run("system admin response is not sanitized", func(t *testing.T) {
+		teams, _, err := th.SystemAdminClient.GetTeamsForScheme(context.Background(), scheme.Id, 0, 100)
+		require.NoError(t, err)
+		require.Len(t, teams, 1)
+		assert.Equal(t, privateTeam.Id, teams[0].Id)
+		assert.Equal(t, knownInviteID, teams[0].InviteId)
+		assert.Equal(t, knownEmail, teams[0].Email)
+	})
+}
+
 func TestGetChannelsForScheme(t *testing.T) {
 	mainHelper.Parallel(t)
 	th := Setup(t).InitBasic()