PT-2026-28424 · Mattermost · Mattermost

Winfunc

·

CVE-2026-3115

·

Publicado

2026-03-26

·

Atualizado

2026-07-30

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0
Description The application fails to enforce view restrictions when retrieving group member IDs. This allows authenticated guest users to enumerate user IDs outside of their permitted visibility scope through the group retrieval API endpoint. The group retrieval endpoint allows unauthorized access to user IDs.
Recommendations Mattermost versions 10.11.x through 10.11.10 should be updated. Mattermost versions 11.2.x through 11.2.2 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Exploit

Correção

DoS

Incorrect Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-3115
GHSA-MPC7-MM28-F6WQ
GO-2026-5512
OPENSUSE-SU-2026:21483-1

Produtos afetados

Mattermost