EUVD-2026-102749
GHSA-mqc4-5px9-95jm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
ExploitCraft modified team search request
-
ExecutionBypass private-team authorization filter
-
ImpactDisclose private team IDs and names
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated Mattermost account that lacks the permission to list private teams (PR:L). The attacker must issue a modified/crafted team-search request against the server's team search functionality to have private teams returned in public search results. Limiting factors: exploitation is capped at disclosure of private team metadata (ID, name, display name) only - no message content, membership, or credentials are exposed - and an attacker must already possess network access and a working user session, so fully unauthenticated external exploitation is not possible. Affects Mattermost 11.7.x ≤ 11.7.9, 11.8.x ≤ 11.8.5, 11.9.x ≤ 11.9.1, and 11.10.x ≤ 11.10.0. |
| Impact | This is a low-severity information-disclosure issue (CVSS 4.3) and should be triaged accordingly, not as a high priority. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is internally consistent and matches the description: a network-reachable, low-complexity attack requiring an existing authenticated low-privileged account, yielding only limited confidentiality impact (team metadata) with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or imminent exploitation. The only signal elevating attention is the authorization bypass (CWE-863) itself, but the impact ceiling is low - leakage of private team IDs, names, and display names, not message content or credentials. No signals conflict; all available data points converge on a genuine-but-minor confidentiality defect. The 'Authentication Bypass' tag is misleading: this is a broken-authorization flaw against already-authenticated users, not an authentication bypass. |
| Exploit ScenarioDerived | An authenticated low-privileged Mattermost user who lacks permission to list private teams submits a modified team-search request and receives private teams in the results. This lets them enumerate the ID, name, and display name of private teams they were never meant to see, aiding reconnaissance of the organization's internal structure. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Private team metadata in Mattermost Server can be enumerated by any authenticated user who lacks the permission to list private teams, because the team search functionality fails to exclude private teams from public search results. An attacker with a valid low-privileged account can send a modified team-search request and retrieve the ID, name, and display name of private teams they are not authorized to see. The issue affects Mattermost 11.7.x through 11.7.9, 11.8.x through 11.8.5, 11.9.x through 11.9.1, and 11.10.x through 11.10.0, and is rated low severity (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with only metadata disclosure - no message content, membership lists, or credentials are exposed; no public exploit was identified at time of analysis.
RemediationAI
No fixed release version is stated in the available data, so administrators should consult the Mattermost security advisory at https://mattermost.com/security-updates (MMSA-2026-00748) and upgrade the server, including any mobile and desktop clients pointed at it, to the patched release for the 11.7, 11.8, 11.9, or 11.10 branch as soon as it is published - patch status must be confirmed against the vendor advisory rather than assumed. Because exploitation requires an authenticated account, the most effective compensating controls are tightening account provisioning and deactivating stale or unnecessary users (side effect: reduced access for legitimate users who no longer need accounts), and reviewing any custom integrations or API tokens that carry broad team-read scopes for unnecessary privileges. Where feasible, restrict network reachability of the Mattermost server to trusted networks or a VPN (trade-off: forces remote staff onto the corporate tunnel and complicates mobile access), and enable and monitor audit logging for anomalous or high-volume team search requests so that post-patch scans for private-team enumeration can be detected. Disabling or restricting the team search feature itself is possible only through custom server modification and would degrade normal user navigation, so it is not recommended as a primary mitigation for this low-severity metadata disclosure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization): Mattermost's team-search path did not enforce the same private-team visibility checks applied elsewhere in the product, so a search request scoped to public teams could be modified to return private-team records. The affected component is the Mattermost server's team search endpoint, reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but requiring a valid authenticated session (PR:L) that specifically lacks private-team listing rights. The vulnerability is confined to confidentiality impact on team-level objects (C:L) - the returned fields are limited to the team ID, name, and display name - with no integrity or availability effect (I:N/A:N). The CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* identifies the Mattermost server as the affected product family, and the vendor tracks the issue as advisory MMSA-2026-00748. Because exploitation depends on a legitimate session plus the ability to craft the search request, this is not remotely exploitable by unauthenticated outsiders, and the practical impact is reconnaissance and information gathering about an organization's internal team structure.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated low-privileged user (PR:L) sends a crafted search over the network (AV:N/AC:L) for limited metadata disclosure, so C:L and I/A:N.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
DescriptionCVE.org
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, which allows an authenticated user without permission to list private teams to disclose the ID, name, and display name of private teams via a modified team search request. Mattermost Advisory ID: MMSA-2026-00748
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Exploit-DB