EUVD-2026-36498
GHSA-rp4v-qc77-phm4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Guest-level authentication required (PR:L); network WebSocket vector (AV:N); only permission metadata disclosed, no integrity or availability impact.
Primary rating from Vendor (Mattermost).
CVSS VectorVendor: Mattermost
Lifecycle Timeline
1DescriptionCVE.org
Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 fail to restrict role_updated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change notifications for private teams they are not a member of via the websocket connection.. Mattermost Advisory ID: MMSA-2026-00616
AnalysisAI
Mattermost's WebSocket layer improperly broadcasts role_updated events to all authenticated connections regardless of team or channel membership, enabling guest-level authenticated users to observe permission scheme change notifications for private teams they do not belong to. Affected versions span the 10.11.x, 11.5.x, and 11.6.x release lines. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and broad version impact make patching a straightforward priority for any Mattermost deployment with guest accounts enabled.
Technical ContextAI
Mattermost is an open-source collaboration platform that uses persistent WebSocket connections to deliver real-time events to clients, including administrative notifications such as role_updated, which signals changes to a team's or channel's permission scheme. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the server-side event dispatcher fails to scope broadcasts of role_updated to only those WebSocket sessions belonging to members of the affected team or channel. Affected products are identified by CPE cpe:2.3:a:mattermost:mattermost:*:*:*:*:*:*:*:* across versions 10.11.0-10.11.16, 11.5.0-11.5.4, and 11.6.0-11.6.1. The flaw is a pure information disclosure with no integrity or availability component; it leaks organizational permission metadata rather than message content or credentials.
RemediationAI
Apply the vendor-released patch per the Mattermost Security Updates advisory at https://mattermost.com/security-updates; the advisory page lists the specific fixed versions for each affected branch (10.11.x, 11.5.x, and 11.6.x), though exact fix version numbers were not independently confirmed in the available intelligence data and should be verified directly from the advisory. As a compensating control prior to patching, administrators can reduce exposure by auditing and minimizing guest account provisioning - disabling or revoking guest access entirely eliminates the attack surface since exploitation requires at minimum a guest-level authenticated session. Restricting WebSocket connectivity at the network layer (e.g., to known corporate IP ranges) would reduce but not eliminate risk for internet-facing deployments. Note that disabling guest accounts may disrupt legitimate external collaborator workflows.
More in Mattermost
View allMattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate boa
Denial of service in linkify-it (npm) through v5.0.0 lets remote unauthenticated attackers wedge a rendering worker by s
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large auto
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded w
A remote code execution vulnerability (CVSS 9.9) that allows authenticated users. Critical severity with potential for s
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate inp
Privilege escalation to full administrative control in Mattermost self-hosted server (versions 11.6.0 and earlier in the
Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that t
Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validat
Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perf
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statemen
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today