PT-2026-25701 · Mattermost · Mattermost

Joshua Rogers · Published 2026-02-16 · Updated 2026-03-27 · CVE-2026-2578

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.3.x through 11.3.0

Description Mattermost versions 11.3.x through 11.3.0 do not maintain the redacted status of burn-on-read posts when they are deleted. This allows channel members to view the content of burn-on-read messages that were intended to be hidden through the WebSocket post deletion event. The issue is related to the handling of post deletion events and the preservation of redaction states.

Recommendations Update Mattermost to a version later than 11.3.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

BDU:2026-06566

CVE-2026-2578

GHSA-3RHR-JR63-HWQ5

GO-2026-4734

SUSE-SU-2026:1135-1

Affected Products

Mattermost

References · 151

• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06566 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2578 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2578 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3rhr-jr63-hwq5 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/c6b205f0d77080ef805783de0628b9526af7faec · Note
• https://suse.com/security/cve/CVE-2026-22545 · Note
• https://suse.com/security/cve/CVE-2026-33281 · Note
• https://suse.com/security/cve/CVE-2026-33132 · Note
• https://suse.com/security/cve/CVE-2026-33191 · Note
• https://suse.com/security/cve/CVE-2026-33066 · Note
• https://suse.com/security/cve/CVE-2026-33315 · Note