Mattermost CVE-2026-3524

Requires Mattermost Plugin Legal Hold version ≤1.1.4 installed and enabled. Attacker must be an authenticated Mattermost user. No victim interaction needed. Exploitation via direct API requests to plugin endpoints.

This represents a high-severity risk to organizations using Mattermost for compliance-sensitive communications. The CVSS score of 8.3 reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H), with network-based attack vector (AV:N) and low attack complexity (AC:L). The PR:L designation indicates any authenticated user can exploit this, not just administrators, significantly expanding the attack surface in multi-user environments. The ability to delete legal hold data (A:H) poses particular compliance risk, as organizations under legal preservation orders could face sanctions if data is destroyed. However, the requirement for authenticated access (PR:L) and lack of scope change (S:U) means exploitation requires valid credentials and remains contained within the vulnerable component. No EPSS score is available, but the authentication requirement reduces likelihood of mass exploitation compared to unauthenticated vulnerabilities. No public exploit code or CISA KEV listing exists, suggesting this remains a patch-priority issue rather than an emergency. Organizations with strong authentication controls and limited Mattermost user bases face lower practical risk, but those in regulated industries (legal, healthcare, finance) should treat this as critical due to compliance implications.

An authenticated attacker with a standard Mattermost user account crafts direct HTTP requests to the Legal Hold plugin's API endpoints, bypassing the normal user interface. Despite the plugin performing authorization checks, the ServeHTTP handler fails to halt processing after detecting insufficient permissions. The attacker enumerates legal hold cases through API calls, downloads preserved communications containing sensitive litigation or compliance data, modifies hold parameters to exclude specific data from preservation, or deletes entire legal hold datasets to obstruct investigations. In a corporate litigation scenario, a disgruntled employee with basic Mattermost access could destroy evidence subject to preservation orders, exposing the organization to legal sanctions. The low attack complexity and network accessibility mean any authenticated user can exploit this without specialized tools or techniques.