EUVD-2026-31428
GHSA-ffpr-pfr4-g354
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without elevated permissions which allows a user without permissions to get data about team members roles via invoking various team API endpoints.. Mattermost Advisory ID: MMSA-2026-00626
AnalysisAI
Team member role data leaks from Mattermost's API across multiple actively maintained release branches due to missing sanitization of response payloads for low-privilege callers. Any authenticated user - regardless of their team role - can invoke standard team API endpoints and receive unsanitized member objects that expose role designations such as admin or system_admin. The vulnerability spans 10.11.x through 11.6.x, has no public exploit code, and is not listed in CISA KEV, but the low attack complexity and broad version coverage make it a meaningful reconnaissance risk in enterprise or multi-tenant deployments.
Technical ContextAI
Mattermost (CPE: cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*) is a self-hosted and cloud team collaboration platform with a REST API that exposes team management endpoints returning team member objects. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class: the server-side serialization or response-filtering layer responsible for stripping privilege-sensitive fields - specifically role designations - based on the requesting user's permission level is absent or incomplete. As a result, the raw team member data structure, including elevated role attributes, is returned in full to any authenticated caller regardless of their actual authorization level. This is an API data over-exposure pattern, not a direct authentication bypass.
RemediationAI
Administrators should consult the Mattermost security advisory MMSA-2026-00626 at https://mattermost.com/security-updates to obtain the exact patched release for their active branch; no specific fix version was included in the available input data, so a confirmed patched version cannot be cited independently. The general remediation is to upgrade to the first available release beyond the affected ceiling in each branch: beyond 11.6.0 on the 11.6.x track, beyond 11.5.3 on the 11.5.x track, beyond 11.4.4 on the 11.4.x track, and beyond 10.11.14 on the 10.11.x track. As a compensating control prior to patching, restrict access to Mattermost team API endpoints at the reverse proxy or firewall layer to trusted internal network ranges only - note this may disrupt legitimate remote or mobile access. Reducing the number of active low-privilege accounts or guest accounts in sensitive workspaces also limits the set of potential exploiters without requiring network-layer changes.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today