What is the CVSS score of EUVD-2026-19231?

EUVD-2026-19231 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mattermost are affected by EUVD-2026-19231?

Mattermost Plugin Legal Hold versions 1.1.4 and earlier contain an authorization bypass flaw that allows authenticated users with low privileges to access, modify, and delete sensitive legal hold…

How to fix or mitigate EUVD-2026-19231?

Within 24 hours: Identify all Mattermost instances running Plugin Legal Hold ≤1.1.4 and document current version inventory. Within 7 days: Restrict API access to the Legal Hold plugin to administrative accounts only via network controls or authentication layer rules; review audit logs for any suspicious legal hold API activity (access, creation, downloads, deletions by non-admin accounts). Within 30 days: Contact Mattermost for patch availability timeline; if patch released, apply immediately to all affected instances; if no patch is available, evaluate migration to alternative compliance-approved legal hold solutions or deprovisioning the plugin pending remediation.

Mattermost EUVD-2026-19231

| CVE-2026-3524 HIGH

Missing Authorization (CWE-862)

2026-04-06 Mattermost

GHSA-h7g6-pq3g-f7cw

Authentication Bypass Mattermost

8.8

CVSS 3.1 · Vendor: Mattermost

Severity by source

Vendor (Mattermost) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Mattermost) · only source for this CVE.

CVSS VectorVendor: Mattermost

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 12:45 euvd

EUVD-2026-19231

Analysis Generated

Apr 06, 2026 - 12:45 vuln.today

CVE Published

Apr 06, 2026 - 12:06 nvd

HIGH 8.8

DescriptionCVE.org

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in ServeHTTP which allows an authenticated attacker to access, create, download, and delete legal hold data via crafted API requests to the plugin's endpoints. Mattermost Advisory ID: MMSA-2026-00621

AnalysisAI

Authorization bypass in Mattermost Plugin Legal Hold versions <=1.1.4 allows authenticated attackers to manipulate legal hold data without proper permission validation. After failed authorization checks, the plugin continues processing requests instead of terminating them, enabling low-privileged authenticated users to access, create, download, and delete sensitive legal hold data through direct API calls. This represents a critical failure in access control enforcement for compliance-critical data. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a critical access control flaw where an application performs an authorization check but fails to enforce the result. In the Mattermost Plugin Legal Hold, the ServeHTTP handler evaluates authorization but does not halt request processing when checks fail, allowing the request to proceed to sensitive operations. Legal hold functionality is designed to preserve data for compliance, litigation, or regulatory purposes, making unauthorized access particularly damaging. The plugin's API endpoints should implement fail-secure behavior where any authorization failure immediately terminates the request. The affected CPE (cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:*) indicates this impacts Mattermost server deployments using the vulnerable plugin versions. The CVSS vector (PR:L) confirms that exploitation requires low-privileged authenticated access, meaning any valid Mattermost user account could potentially exploit this flaw if they can craft API requests directly to plugin endpoints.

RemediationAI

Organizations should immediately upgrade Mattermost Plugin Legal Hold to version 1.1.5 or later, which addresses the authorization enforcement failure in ServeHTTP. Administrators can update plugins through the Mattermost System Console under Plugin Management, or by manually replacing plugin files if using custom deployment methods. Until patching is completed, consider temporarily disabling the Legal Hold plugin if operationally feasible, particularly in environments where legal hold functionality is not actively required. Review audit logs for suspicious API activity targeting legal hold endpoints during the vulnerable period, looking for unauthorized access, modifications, or deletions by low-privileged users. Implement network-level access controls to restrict API endpoint access if disabling the plugin is not possible. Consult the official Mattermost security advisory at https://mattermost.com/security-updates (MMSA-2026-00621) for additional vendor-specific guidance and verification procedures.