PT-2026-25701 · Mattermost · Mattermost

Joshua Rogers · Publicado 2026-02-16 · Atualizado 2026-03-27 · CVE-2026-2578

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.3.x through 11.3.0

Description Mattermost versions 11.3.x through 11.3.0 do not maintain the redacted status of burn-on-read posts when they are deleted. This allows channel members to view the content of burn-on-read messages that were intended to be hidden through the WebSocket post deletion event. The issue is related to the handling of post deletion events and the preservation of redaction states.

Recommendations Update Mattermost to a version later than 11.3.0.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-201

CWE-200

Identificadores relacionados

BDU:2026-06566

CVE-2026-2578

GHSA-3RHR-JR63-HWQ5

GO-2026-4734

SUSE-SU-2026:1135-1

Produtos afetados

Mattermost

Referências · 151

• https://github.com/mattermost/mattermost · Nota
• https://github.com/mattermost/mattermost/commit/c6b205f0d77080ef805783de0628b9526af7faec · Nota
• https://suse.com/security/cve/CVE-2026-22545 · Nota
• https://suse.com/security/cve/CVE-2026-33281 · Nota
• https://suse.com/security/cve/CVE-2026-33132 · Nota
• https://suse.com/security/cve/CVE-2026-33191 · Nota
• https://suse.com/security/cve/CVE-2026-33066 · Nota
• https://suse.com/security/cve/CVE-2026-33315 · Nota
• https://suse.com/security/cve/CVE-2026-33247 · Nota
• https://suse.com/security/cve/CVE-2026-33620 · Nota
• https://suse.com/security/cve/CVE-2026-32595 · Nota
• https://suse.com/security/cve/CVE-2026-2458 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2578 · Nota
• https://suse.com/security/cve/CVE-2026-33222 · Nota
• https://suse.com/security/cve/CVE-2026-33675 · Nota