PT-2026-28424 · Mattermost · Mattermost

Winfunc · Published 2026-03-26 · Updated 2026-03-27 · CVE-2026-3115

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0

Description The application fails to enforce view restrictions when retrieving group member IDs. This allows authenticated guest users to enumerate user IDs outside of their permitted visibility scope through the group retrieval API endpoint. The group retrieval endpoint allows unauthorized access to user IDs.

Recommendations Mattermost versions 10.11.x through 10.11.10 should be updated. Mattermost versions 11.2.x through 11.2.2 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-3115

GHSA-MPC7-MM28-F6WQ

Affected Products

Mattermost

References · 7

• https://mattermost.com/security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3115 · Security Note
• https://osv.dev/vulnerability/GHSA-mpc7-mm28-f6wq · Vendor Advisory
• https://github.com/mattermost/mattermost · Note
• https://twitter.com/infoflowcloud/status/2037515695106179473 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3115 · Note
• https://twitter.com/CVEnew/status/2037513444035797128 · Twitter Post