Mattermost CVE-2026-3115

This vulnerability presents low-to-moderate real-world risk despite a moderate CVSS score. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms it requires authenticated access (PR:L), has low attack complexity, and causes only partial confidentiality impact with no integrity or availability consequences. CISA's SSVC decision framework corroborates this: exploitation status is 'none' (no active exploitation observed), automatable impact is 'no' (manual enumeration required), and technical impact is 'partial' (limited to information disclosure). The vulnerability does not enable privilege escalation, data exfiltration, or service disruption-only user ID enumeration. Organizations with strict guest-account policies or those running air-gapped deployments face lower practical risk. However, installations allowing guest access to sensitive groups should prioritize patching to prevent user discovery in sensitive organizational hierarchies.

An authenticated guest user-perhaps a temporary contractor or external collaborator with limited platform access-crafts repeated requests to the group member retrieval endpoint, systematically enumerating user IDs from groups they are not authorized to view. Because view restrictions are not enforced, the endpoint returns full user ID lists, allowing the attacker to build a complete organizational map of internal users and their group memberships. This enumeration could inform subsequent social engineering, phishing, or account-targeting attacks, but requires no special tools or complex exploitation techniques-HTTP requests alone suffice. No publicly disclosed proof-of-concept code exists, but the straightforward nature of the endpoint manipulation (low complexity, POST/GET to group APIs) makes reproducibility trivial for any authenticated user.