PT-2026-30601 · Mattermost · Mattermost Plugin Legal Hold

Hassan Mohammed · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-3524

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mattermost Plugin Legal Hold versions 1.1.4 and earlier

Description The Mattermost Plugin Legal Hold software, versions 1.1.4 and earlier, does not properly halt request processing after an authorization failure within the ServeHTTP function. This allows an authenticated attacker to access, create, download, and delete legal hold data by sending crafted API requests to the plugin's endpoints. The vulnerability stems from a failure to stop processing after an authorization check fails.

Recommendations Update Mattermost Plugin Legal Hold to a version later than 1.1.4.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3524

Affected Products

Mattermost Plugin Legal Hold

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3524 · Security Note
• https://mattermost.com/security-updates · Vendor Advisory
• https://twitter.com/CveFindCom/status/2041149624665125069 · Twitter Post
• https://twitter.com/CVEnew/status/2041141634432475420 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2041148536264204417 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041142871286304924 · Twitter Post
• https://twitter.com/TheHackerWire/status/2041143505364668613 · Twitter Post