GHSA-cwfj-642j-gfh4

ghsaUSosv

Mattermost fails to properly enforce read permissions in search API endpoints

view advisory published 2026-03-16Licence: CC-BY-4.0

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-24692US	—OT elevated	0.17% (6th)	—	2026-03-16
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read…

references

External citations — patches, advisories, analysis.

https://github.com/mattermost/mattermostPACKAGE
https://github.com/mattermost/mattermost/commit/0481bd1fb04584db97eca45fd58ebd06c8200df4WEB
https://mattermost.com/security-updatesWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-24692ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan