CESS-2026-24692 — Vulnetix

CESS-2026-24692 PUBLISHED CVSS 4.3 MEDIUM

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

Risk Scores

CVSS 3.1

4.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Timeline

Mar 16, 2026 CVE Published

Open in Interactive Console →