CVE-2026-3115 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-3115 PUBLISHED CVSS 4.300000190734863 MEDIUM

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594

Risk Scores

CVSS v3.1

4.300000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected Products

Vendor	Product	Versions
Mattermost	Mattermost	11.2.0, 10.11.0, 11.4.0
github.com	mattermost/mattermost/server/v8	11.4.0, 11.4.0, 11.3.0-rc1
mattermost	mattermost_server	10.11.0, 11.2.0, 11.3.0

Timeline

Mar 26, 2026 CVE Published
Mar 27, 2026 Coalition ESS Score
Mar 27, 2026 Security Advisory
Mar 29, 2026 Security Advisory
Mar 31, 2026 CVE Updated

References

MMSA-2026-00594 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-3115 advisory
https://github.com/mattermost/mattermost package

Open in Interactive Console →