PT-2026-28424 · Mattermost · Mattermost

Winfunc

·

CVE-2026-3115

·

Published

2026-03-26

·

Updated

2026-07-30

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.10 Mattermost versions 11.2.x through 11.2.2 Mattermost versions 11.3.x through 11.3.1 Mattermost versions 11.4.x through 11.4.0
Description The application fails to enforce view restrictions when retrieving group member IDs. This allows authenticated guest users to enumerate user IDs outside of their permitted visibility scope through the group retrieval API endpoint. The group retrieval endpoint allows unauthorized access to user IDs.
Recommendations Mattermost versions 10.11.x through 10.11.10 should be updated. Mattermost versions 11.2.x through 11.2.2 should be updated. Mattermost versions 11.3.x through 11.3.1 should be updated. Mattermost versions 11.4.x through 11.4.0 should be updated.

Exploit

Fix

DoS

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-3115
GHSA-MPC7-MM28-F6WQ
GO-2026-5512
OPENSUSE-SU-2026:21483-1

Affected Products

Mattermost