Mattermost CVE-2026-16047

Exploitation requires an authenticated Mattermost account with at minimum standard team membership, as confirmed by the CVSS PR:L metric. The attacker must be a member of the same Mattermost team as the target private channel - cross-team channel enumeration is not possible. The Boards feature must be enabled on the instance, which is the default state in affected versions. The vulnerability is exercised through the board management API endpoints (create, patch, import, or bulk-create operations) by supplying an arbitrary channelId value; UI-level access controls do not prevent this API-level bypass. Exploitation is bounded to membership discovery - message content, file attachments, and channel history are not exposed. The CVSS vector contains no UI:R or scope change, confirming fully server-side exploitation with no victim interaction required.

The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is internally consistent with the vulnerability's behavior: network exploitable with no complexity, requiring only a low-privilege authenticated account, with impact limited to low confidentiality. No EPSS score was provided in the source data, so exploitation probability must be inferred from the CVSS signals - AC:L and PR:L together suggest this would be straightforward for any insider or compromised account to weaponize. The vulnerability is not listed in the CISA KEV catalog, and no POC is publicly available at time of analysis, which meaningfully lowers the urgency compared to a KEV-listed flaw with comparable CVSS. Real-world risk concentrates in organizations where private channel membership itself is operationally sensitive - legal, HR, executive communications, or regulated-industry workloads - where knowing who is in a channel can enable targeted social engineering or insider threat activity. For general enterprise Mattermost deployments, the practical impact is reconnaissance-grade, not destructive.

An authenticated Mattermost team member - such as a low-privilege employee or an attacker who has compromised any valid account - submits a board creation or import API request with a guessed or enumerated channelId belonging to a private channel on the same team. By observing whether the server accepts the channelId and returns membership-related metadata, the attacker systematically maps which private channels exist and who belongs to them. No public exploit code exists at time of analysis; the technique requires only a valid session token and iterative API calls.