What is the CVSS score of CVE-2026-3636?

CVE-2026-3636 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-3636?

Yes, a patch is available for CVE-2026-3636. Update the affected software to the latest version immediately.

Mattermost CVE-2026-3636

Q: Which versions of Mattermost are affected by CVE-2026-3636?

Team member role data leaks from Mattermost's API across multiple actively maintained release branches due to missing sanitization of response payloads for low-privilege callers.. A patch is available.

EUVD-2026-31428 MEDIUM

Information Exposure (CWE-200)

2026-05-22 Mattermost

GHSA-ffpr-pfr4-g354

Information Disclosure Mattermost

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints.. Mattermost Advisory ID: MMSA-2026-00626

AnalysisAI

Team member role data leaks from Mattermost's API across multiple actively maintained release branches due to missing sanitization of response payloads for low-privilege callers. Any authenticated user - regardless of their team role - can invoke standard team API endpoints and receive unsanitized member objects that expose role designations such as admin or system_admin. The vulnerability spans 10.11.x through 11.6.x, has no public exploit code, and is not listed in CISA KEV, but the low attack complexity and broad version coverage make it a meaningful reconnaissance risk in enterprise or multi-tenant deployments.

Technical ContextAI

Mattermost (CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*) is a self-hosted and cloud team collaboration platform with a REST API that exposes team management endpoints returning team member objects. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class: the server-side serialization or response-filtering layer responsible for stripping privilege-sensitive fields - specifically role designations - based on the requesting user's permission level is absent or incomplete. As a result, the raw team member data structure, including elevated role attributes, is returned in full to any authenticated caller regardless of their actual authorization level. This is an API data over-exposure pattern, not a direct authentication bypass.

RemediationAI

Administrators should consult the Mattermost security advisory MMSA-2026-00626 at https://mattermost.com/security-updates to obtain the exact patched release for their active branch; no specific fix version was included in the available input data, so a confirmed patched version cannot be cited independently. The general remediation is to upgrade to the first available release beyond the affected ceiling in each branch: beyond 11.6.0 on the 11.6.x track, beyond 11.5.3 on the 11.5.x track, beyond 11.4.4 on the 11.4.x track, and beyond 10.11.14 on the 10.11.x track. As a compensating control prior to patching, restrict access to Mattermost team API endpoints at the reverse proxy or firewall layer to trusted internal network ranges only - note this may disrupt legitimate remote or mobile access. Reducing the number of active low-privilege accounts or guest accounts in sensitive workspaces also limits the set of potential exploiters without requiring network-layer changes.