PT-2026-25759 · Mattermost · Mattermost

0X7Oda7123 · CVE-2026-24692 · Published 2026-02-13 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.0 through 10.11.10 Mattermost versions 11.2.0 through 11.2.2 Mattermost versions 11.3.0

Description Mattermost does not correctly enforce read permissions in the search API endpoints. This allows guest users without read permissions to access posts and files in channels by making requests to the search API. The vulnerable API endpoints are not explicitly specified. The search API is affected. The vulnerable parameter is not specified.

Recommendations Mattermost versions 10.11.0 through 10.11.10 should be updated. Mattermost versions 11.2.0 through 11.2.2 should be updated. Mattermost version 11.3.0 should be updated.

Exploit

Fix

DoS

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

BDU:2026-06561

CVE-2026-24692

GHSA-CWFJ-642J-GFH4

GO-2026-4745

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:1135-1

Affected Products

Mattermost

References · 1750

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24692.json · Exploit
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4745 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06561 · Security Note
• https://osv.dev/vulnerability/GHSA-cwfj-642j-gfh4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24692 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24692 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://github.com/mattermost/mattermost/commit/0481bd1fb04584db97eca45fd58ebd06c8200df4 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note