An issue exists in Mattermost Server prior to 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
mattermost mattermost server