What is the CVSS score of EUVD-2026-16245?

EUVD-2026-16245 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-16245?

CVE-2026-3115 presents moderate security risk, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate EUVD-2026-16245?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mattermost EUVD-2026-16245

| CVE-2026-3115 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 Mattermost

Authentication Bypass Mattermost

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16245

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 16:23 nvd

MEDIUM 4.3

DescriptionCVE.org

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to apply view restrictions when retrieving group member IDs, which allows authenticated guest users to enumerate user IDs outside their allowed visibility scope via the group retrieval endpoint.. Mattermost Advisory ID: MMSA-2026-00594

AnalysisAI

Mattermost versions 11.2.x through 11.4.x fail to enforce view restrictions on group member endpoints, allowing authenticated guest users to enumerate user IDs beyond their authorized visibility scope. This authorization bypass requires valid credentials but enables attackers to discover internal user information through the group retrieval API. No patch is currently available for affected versions.

Technical ContextAI

The vulnerability stems from improper access control (CWE-863: Improper Authorization) in Mattermost's group member endpoint. When guest users-authenticated accounts with restricted permissions-query the group retrieval API, the application fails to apply visibility filtering rules that ordinarily restrict which users appear in results based on configured scopes and group membership. Mattermost (cpe:2.3:a:mattermost:mattermost) is a self-hosted, open-source team collaboration platform that manages user visibility through role-based access control (RBAC) and organizational boundaries. The flaw allows these controls to be bypassed specifically for group member ID enumeration, exposing internal user identifiers that could be used for downstream reconnaissance or targeted attacks.

RemediationAI

Upgrade affected Mattermost instances to patched releases immediately. Users on version 10.11.x should update to 10.11.11 or later; those on 11.2.x should upgrade to 11.2.3 or later; 11.3.x users should move to 11.3.2 or later; and 11.4.x users should update to 11.4.1 or later (consult the Mattermost security advisory at https://mattermost.com/security-updates for exact patched versions). As an interim control, restrict guest-account creation and assignment to non-sensitive groups, and monitor API logs for unusual group-member enumeration requests. Network-level access controls limiting group endpoint exposure to trusted IP ranges can reduce attack surface until patching is completed.