EUVD-2026-12415
GHSA-3rhr-jr63-hwq5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermost Advisory ID: MMSA-2026-00579
AnalysisAI
Mattermost versions 11.3.x up to and including 11.3.0 contain an information disclosure vulnerability where burn-on-read posts fail to maintain their redacted state when deleted, allowing authenticated channel members to view previously hidden message contents through WebSocket post deletion events. The vulnerability requires low-privilege authenticated access and results in confidentiality loss of sensitive communications that were intentionally designed to be self-destructing. With a CVSS score of 4.3 and network-based attack vector, this represents a meaningful but contained risk primarily affecting organizations relying on Mattermost's burn-on-read feature for secure internal communications.
Technical ContextAI
Mattermost is a self-hosted team collaboration platform that implements secure messaging features including burn-on-read posts, which are designed to be automatically redacted after viewing. The vulnerability exists in the WebSocket event handling layer that processes post deletion operations. When a burn-on-read post is deleted, the system fails to properly preserve or validate the redacted state before broadcasting the deletion event to connected clients (CWE-201: Exposure of Sensitive Information Through an Error Message). This is a state-management flaw where sensitive data that should be cryptographically protected or completely removed from the event payload is instead exposed in plaintext during the WebSocket deletion notification. The CPE identifier is cpe:2.3:a:mattermost:mattermost_server:11.3.0 and related 11.3.x versions, affecting the core messaging server component responsible for WebSocket communications.
RemediationAI
Upgrade Mattermost Server immediately to a patched version beyond 11.3.0 (consult MMSA-2026-00579 for the specific patched version number, typically the next minor or patch release). If immediate patching is not possible, implement network-level access controls to restrict WebSocket connections to trusted internal networks only, and audit channel membership to ensure burn-on-read posts are only shared with personnel with a legitimate need to access them. Consider temporarily disabling the burn-on-read feature for highly sensitive channels until patching is complete. As a compensating control, implement WebSocket connection logging and monitoring to detect suspicious patterns of post deletion event consumption that might indicate exploitation attempts.
More in Mattermost
View allDenial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invit
Dex is a federated OpenID Connect provider written in Go. Rated critical severity (CVSS 9.6), this vulnerability is remo
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, wh
Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker posse
Privilege escalation in Mattermost server (11.6.x, 11.5.x, and 10.11.x branches) allows a low-privileged user holding gr
Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today