What is the CVSS score of CVE-2026-3113?

CVE-2026-3113 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-3113?

CVE-2026-3113 presents moderate security risk, a incorrect permissions vulnerability rated CVSS 5.0. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-3113?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review and tighten file/resource permissions.

Mattermost CVE-2026-3113

EUVD-2026-16240 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-03-26 Mattermost

GHSA-4765-v66x-rqx7

Information Disclosure Mattermost

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16240

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:18 nvd

MEDIUM 5.0

DescriptionCVE.org

Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593

AnalysisAI

Mattermost bulk export functionality fails to apply proper file permissions, allowing unprivileged local users on affected servers to read sensitive exported data. Mattermost versions 11.4.0, 11.3.x through 11.3.1, 11.2.x through 11.2.3, and 10.11.x through 10.11.11 are vulnerable (CVE-2026-3113, MMSA-2026-00593). An authenticated local attacker with login credentials can access bulk export files created by other users, leading to unauthorized information disclosure of potentially sensitive team and channel communications. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog, though the vulnerability's automatable nature and low attack complexity warrant prompt patching.

Technical ContextAI

The vulnerability stems from improper file permission handling (CWE-732: Incorrect Permission Assignment for Critical Resource) in Mattermost's bulk export download mechanism. When administrators or users generate bulk export files from Mattermost collaboration data, the exported files are written to the server filesystem without appropriate POSIX permissions or access control lists that would restrict read access to the file owner. Mattermost is a self-hosted team communication platform implemented in Go and runs as a service process on Linux/Unix-like systems. The affected versions are identified via CPE (cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*). Because exported files typically reside in shared or world-readable directories, any local user account with shell access to the server can enumerate and read these files, bypassing Mattermost's application-level access controls.

RemediationAI

Upgrade affected Mattermost installations to patched versions immediately: version 10.11.12 or later for the 10.11.x line, version 11.2.4 or later for the 11.2.x line, version 11.3.2 or later for the 11.3.x line, or version 11.4.1 or later for the 11.4.x line. See https://mattermost.com/security-updates for specific patch availability and release notes. Until patching is feasible, implement operating-system-level mitigations: restrict shell access to the Mattermost server to only authorized administrators, configure the Mattermost installation directory with appropriate POSIX permissions (e.g., 0750 on parent directories, 0640 on bulk export files) via SELinux or AppArmor policies if available, and audit the server filesystem for existing unprotected export files that may have been created by previous versions. Additionally, consider moving bulk export output to restricted directories outside the web-accessible path and implementing mandatory file encryption at rest for sensitive data.