What is the CVSS score of CVE-2026-4274?

CVE-2026-4274 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by CVE-2026-4274?

CVE-2026-4274 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-4274?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost CVE-2026-4274

EUVD-2026-16162 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 Mattermost

Mattermost Privilege Escalation Debian

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 11:00 euvd

EUVD-2026-16162

Analysis Generated

Mar 26, 2026 - 11:00 vuln.today

CVE Published

Mar 26, 2026 - 10:43 nvd

MEDIUM 5.4

DescriptionCVE.org

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared channel via sending crafted membership sync messages that trigger team membership assignment. Mattermost Advisory ID: MMSA-2026-00574

AnalysisAI

Mattermost versions 11.2.x through 11.2.2, 10.11.x through 10.11.10, 11.4.0, and 11.3.x through 11.3.1 fail to properly restrict team-level access during remote cluster membership synchronization, allowing a malicious remote cluster to grant users access to entire private teams rather than limiting access to only shared channels. An authenticated attacker controlling a federated remote cluster can send crafted membership sync messages to trigger unintended team membership assignment, resulting in unauthorized access to private team resources. The EPSS score of 0.03% (percentile 7%) indicates low real-world exploitation probability, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in Mattermost's cluster federation and shared channel membership synchronization mechanism (CPE: cpe:2.3:a:mattermost:mattermost). When processing membership sync messages from remote clusters, Mattermost fails to enforce proper access control boundaries between shared channel membership and team-level membership, classified under CWE-863 (Incorrect Authorization). The root cause is inadequate validation of membership scope during the sync operation-the system does not verify that remote cluster membership changes are restricted to the intended shared channel context before applying them at the team level, allowing scope escalation from channel to team.

RemediationAI

Upgrade affected Mattermost instances to patched versions: 11.2.3 or later for the 11.2.x branch, 10.11.11 or later for the 10.11.x branch, 11.3.2 or later for the 11.3.x branch, and 11.5.0 or later for the 11.4.x branch (consult vendor advisory for exact version mapping). Until patching is feasible, restrict federation to trusted remote clusters only and implement network-level isolation of cluster-to-cluster communication channels. Review and audit existing shared channel memberships across federated clusters to identify any unauthorized team-level access grants. Enable logging and monitoring of membership sync operations to detect anomalous membership changes. See https://mattermost.com/security-updates for complete patch details and migration guidance.