What is the CVSS score of CVE-2026-3433?

CVE-2026-3433 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Mattermost CVE-2026-3433

EUVD-2026-36498 MEDIUM

Information Exposure (CWE-200)

2026-06-12 Mattermost

GHSA-rp4v-qc77-phm4

Mattermost Information Disclosure

4.3

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Guest-level authentication required (PR:L); network WebSocket vector (AV:N); only permission metadata disclosed, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Mattermost).

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 12, 2026 - 17:33 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616

AnalysisAI

Mattermost's WebSocket layer improperly broadcasts role_updated events to all authenticated connections regardless of team or channel membership, enabling guest-level authenticated users to observe permission scheme change notifications for private teams they do not belong to. Affected versions span the 10.11.x, 11.5.x, and 11.6.x release lines. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and broad version impact make patching a straightforward priority for any Mattermost deployment with guest accounts enabled.

Technical ContextAI

Mattermost is an open-source collaboration platform that uses persistent WebSocket connections to deliver real-time events to clients, including administrative notifications such as role_updated, which signals changes to a team's or channel's permission scheme. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the server-side event dispatcher fails to scope broadcasts of role_updated to only those WebSocket sessions belonging to members of the affected team or channel. Affected products are identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* across versions 10.11.0-10.11.16, 11.5.0-11.5.4, and 11.6.0-11.6.1. The flaw is a pure information disclosure with no integrity or availability component; it leaks organizational permission metadata rather than message content or credentials.

RemediationAI

Apply the vendor-released patch per the Mattermost Security Updates advisory at https://mattermost.com/security-updates; the advisory page lists the specific fixed versions for each affected branch (10.11.x, 11.5.x, and 11.6.x), though exact fix version numbers were not independently confirmed in the available intelligence data and should be verified directly from the advisory. As a compensating control prior to patching, administrators can reduce exposure by auditing and minimizing guest account provisioning - disabling or revoking guest access entirely eliminates the attack surface since exploitation requires at minimum a guest-level authenticated session. Restricting WebSocket connectivity at the network layer (e.g., to known corporate IP ranges) would reduce but not eliminate risk for internet-facing deployments. Note that disabling guest accounts may disrupt legitimate external collaborator workflows.