EUVD-2026-102746
GHSA-3m39-x8xr-762f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Mattermost user
-
ExploitSend direct API call targeting a post
-
ImpactInfer post's flagged review status from response
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V6 - Authentication Timing-safe comparisons
|
| Exploitation Conditions | Requires an authenticated Mattermost account that is a member able to reach the affected API endpoint but is NOT granted content-reviewer permissions; exploitation is a direct API call rather than normal UI usage. The deployment must have content/post flagging (moderation review) in use for a flagged status to exist and be inferable. Limiting factors: valid credentials are required (PR:L - not anonymous), the disclosure is confined to a single binary signal (a post's flagged status) with no access to post content or moderation details, and installations not using the flagged-post review feature have nothing meaningful to leak. |
| Impact | This is a low-severity information disclosure issue (CVSS 4.3) that is a genuinely low real-world priority. The vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is internally consistent with the description: network-reachable API, low complexity, but requiring an authenticated low-privilege account (PR:L), no user interaction, unchanged scope, and only limited confidentiality impact (C:L) with no integrity or availability effect. The root cause is CWE-203 (observable discrepancy) - permission checks run after other validations, letting a user who is not a content reviewer infer whether a post has been flagged. No EPSS score was provided, there is no CISA KEV listing (not KEV), and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. All signals align downward: the only leaked data is a binary flagged/not-flagged status, the attacker must already be an authenticated member, and there is no code execution or data modification. There is no conflict among the signals to flag; the main missing data points are EPSS probability and any independent confirmation of exploitability, but none of these would elevate a limited metadata-inference bug of this kind. |
| Exploit ScenarioDerived | An authenticated Mattermost user who lacks content-reviewer permissions issues a crafted direct call to the relevant API endpoint and, because the permission check is deferred behind other validations, is able to deduce whether a given post has been flagged for review. No public exploit code is referenced, and the attacker gains only moderation metadata, not post contents, moderation decisions, or any write capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Flagged-post review status in Mattermost can be inferred by authenticated users who lack content-reviewer permissions, because the affected API performs other validations before checking the caller's permissions, producing a distinguishable response for flagged versus unflagged posts. The issue affects 11.10.x through 11.10.0, 11.9.x through 11.9.1, 11.8.x through 11.8.5, and 11.7.x through 11.7.9 (advisory MMSA-2026-00754), and exploitation requires a valid account on a deployment that actually uses the post-flagging/moderation feature, with attacker access limited to a single binary signal and no exposure of post content or reviewer details. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N); no public exploit identified at time of analysis, and this is a genuinely low real-world priority.
RemediationAI
No exact fixed version is provided in the available intelligence; the vendor advisory page https://mattermost.com/security-updates (under MMSA-2026-00754) lists the patched builds, so upgrade each affected 11.7.x, 11.8.x, 11.9.x, and 11.10.x deployment to the corresponding fixed release line identified there, or to the current supported release for older branches. Compensating controls are constrained because the leak is a single boolean on an endpoint that legitimate content reviewers also use: fronting the post-flagging/review API routes with a reverse-proxy ACL restricted to accounts holding the content-reviewer role reduces exposure but must be kept synchronized with Mattermost role changes and can break moderation tooling in the web and mobile clients if the ACL is too broad. Disabling or not adopting the content-flagging/moderation-review feature removes the asset entirely and eliminates any inference surface, at the cost of losing the moderation workflow, and narrowing the population of ordinary member accounts on channels where moderation matters shrinks the set of potential callers. Given that exploitation requires valid credentials (PR:L) and yields only the flagged status of one post, schedule this within a normal patch cycle rather than as an emergency change, and treat the finding as informational until the upgrade is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Mattermost is a self-hosted team collaboration platform whose server exposes a REST API used by its web, desktop, and mobile clients; the CPE record cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* confirms the server product is the affected component and that the flaw spans multiple supported release branches rather than a single build. The root cause class is CWE-203 (Observable Discrepancy): the endpoint handling post-flag/moderation-review state evaluates other validity conditions before confirming that the requesting user holds the content-reviewer permission, so a non-reviewer's direct API call receives a response that differs depending on whether the target post has been flagged - a classic state oracle in which the side channel, not the returned data, carries the secret. Content flagging exists to let designated reviewers triage reported posts, so the flagged/not-flagged bit is the entire protected asset here; no post body, reporter identity, or moderation note is exposed, which is why the assessed impact is limited to low confidentiality with no integrity or availability effect. Because the prerequisite is a legitimate authenticated session (PR:L) rather than anonymity, the practical threat is an insider or ordinary member enumerating post IDs to map which content is under moderation, and only installations where the flagging feature is actively in use have anything to leak.
Know when Mattermost gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network API reachable with low complexity but requires an authenticated low-privilege user (PR:L); only a flagged-status metadata bit leaks, so C:L with I:N/A:N.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
DescriptionCVE.org
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Exploit-DB