EUVD-2026-16240
GHSA-4765-v66x-rqx7
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.4.x <= 11.4.0, 11.3.x <= 11.3.1, 11.2.x <= 11.2.3, 10.11.x <= 10.11.11 fail to set permissions on downloaded bulk export which allows other local users on the server to be able to read contents of the bulk export.. Mattermost Advisory ID: MMSA-2026-00593
AnalysisAI
Mattermost bulk export functionality fails to apply proper file permissions, allowing unprivileged local users on affected servers to read sensitive exported data. Mattermost versions 11.4.0, 11.3.x through 11.3.1, 11.2.x through 11.2.3, and 10.11.x through 10.11.11 are vulnerable (CVE-2026-3113, MMSA-2026-00593). An authenticated local attacker with login credentials can access bulk export files created by other users, leading to unauthorized information disclosure of potentially sensitive team and channel communications. No public exploit code has been identified at time of analysis, and CISA has not listed this in the Known Exploited Vulnerabilities catalog, though the vulnerability's automatable nature and low attack complexity warrant prompt patching.
Technical ContextAI
The vulnerability stems from improper file permission handling (CWE-732: Incorrect Permission Assignment for Critical Resource) in Mattermost's bulk export download mechanism. When administrators or users generate bulk export files from Mattermost collaboration data, the exported files are written to the server filesystem without appropriate POSIX permissions or access control lists that would restrict read access to the file owner. Mattermost is a self-hosted team communication platform implemented in Go and runs as a service process on Linux/Unix-like systems. The affected versions are identified via CPE (cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*). Because exported files typically reside in shared or world-readable directories, any local user account with shell access to the server can enumerate and read these files, bypassing Mattermost's application-level access controls.
RemediationAI
Upgrade affected Mattermost installations to patched versions immediately: version 10.11.12 or later for the 10.11.x line, version 11.2.4 or later for the 11.2.x line, version 11.3.2 or later for the 11.3.x line, or version 11.4.1 or later for the 11.4.x line. See https://mattermost.com/security-updates for specific patch availability and release notes. Until patching is feasible, implement operating-system-level mitigations: restrict shell access to the Mattermost server to only authorized administrators, configure the Mattermost installation directory with appropriate POSIX permissions (e.g., 0750 on parent directories, 0640 on bulk export files) via SELinux or AppArmor policies if available, and audit the server filesystem for existing unprotected export files that may have been created by previous versions. Additionally, consider moving bulk export output to restricted directories outside the web-accessible path and implementing mandatory file encryption at rest for sensitive data.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same technique Information Disclosure
View allVendor StatusVendor
Debian
Bug #823556| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today